Exchange your client credentials for a bearer token and send it on every request.
| API Key | Label | Last Used | |
|---|---|---|---|
Payment Labs has one login for the whole platform. Create Access Token (POST /login) returns a token that works for every Payment Labs API: payouts, payment requests, wallets and payins. Every other operation needs that token.
Get credentials
Payment Labs issues a client ID (key) and a secret for your account. Each credential carries a role, and the role decides what the token can do. For example, managing webhooks needs the payout Administrator role. Contact Payment Labs to get or rotate credentials. Issuing a new secret invalidates the old one immediately.
Get a token
Send your credentials to POST /login with method set to client-secret:
curl -X POST https://api-sandbox.paymentlabs.io/login \
-H "Content-Type: application/json" \
-d '{"method": "client-secret", "key": "<client-id>", "secret": "<secret>"}'The response is 200 with {"token": "<jwt>"}. A failed login returns 400, never 401.
Use the token
Send the token in the Authorization header:
Authorization: Bearer <token>- The token expires 3 hours after it is issued. There is no refresh token: call
POST /loginagain. - A token issued for API credentials belongs to exactly one account, so you do not need to send
x-payor-id.
Authentication errors
| Status | Meaning | What to do |
|---|---|---|
401 | The token is missing, invalid, or expired. | Get a new token with POST /login and retry. |
403 | The token is valid, but its role does not allow this operation. | Use credentials with the required role. See Permissions; for wallets and payment requests, see Wallets, wallet disputes and payment requests. |
For the full flow, roles, and error codes, see Environments and Authentication.