Exchanges your API credentials for an access token. This is the single login for the whole Payment Labs API: the same
token works for payouts, payment requests, wallets and payins, and every other operation needs it.

Before you start, ask Payment Labs for API credentials: a client ID and a secret for each environment (sandbox and
production). You cannot create, list or rotate credentials yourself. Each credential carries a payout role, which decides
what the token can do. The role names are the ones shown in the dashboard:

• Administrator: every payout operation, including webhook configuration and the payment availability period.
• Expert User: read, create and change records, and approve payments.
• User: read, create and change records.
• Approver: read and approve payments.
• Viewer: read only.

Credentials for accepting payins carry a merchant role instead, or as well: Merchant Administrator, Merchant Approver,
Merchant User or Merchant Viewer. See Permissions. A call to an operation the role does
not allow returns 403 FORBIDDEN_INSUFFICIENT_TAGS. When Payment Labs issues a new secret for your client ID, the old secret stops
working at once.

How to authenticate:

1. Send POST /login with {"method": "client-secret", "key": "<client ID>", "secret": "<secret>"}. This call takes no token.
2. Read token from the response.
3. Send it on every other request in the Authorization header: Authorization: Bearer <token>.
4. The token expires 3 hours after it is issued, and it cannot be refreshed. Call POST /login again before it expires, or
   when a request returns 401, then retry that request with the new token. Reuse a token across
   requests instead of logging in for each one.

A token from API credentials belongs to exactly one payor, so you never need the x-payor-id header. That header is only for
dashboard users who belong to several payors; it selects the payor a request acts on.

Errors

Every failure returns 400, never 401 or 403:

• MISSING_KEY: key is missing or empty.
• MISSING_SECRET: secret is missing or empty.
• INVALID_KEY_OR_SECRET: the client ID and secret do not match. Check that you are using the credentials for this
  environment.
• INVALID_KEY: the credentials are no longer linked to an active payor account. Contact Payment Labs.
• INVALID_METHOD: method is missing or not recognised. Always send client-secret; any other value fails with 400.

A request with no body returns 400 with the plain-text body Missing request body. A body that is not valid JSON returns
400 with the plain-text body Invalid body.