Onboarding

Get Started

Payblr uses OAuth 2.0 Client Credentials to provide secure access to protected API resources. Before calling Payblr APIs, your application must obtain an access token and include it in the Authorization header of each API request.

Updated 15 minutes ago

On this page

Overview Receive credentials Obtain an access token Call Payblr APIs Security notes Next steps

Overview

Payblr APIs are protected resources. To access them, your application must authenticate using credentials provided by Payblr and request an access token from the authorization endpoint.

Once your system receives an access token, it can call Payblr APIs by sending the token as a bearer token in the request header.

Step	Description
1. Receive credentials	Payblr provides your application credentials for the applicable environment.
2. Obtain an access token	Your system requests an access token using the OAuth 2.0 Client Credentials grant type.
3. Call Payblr APIs	Your system includes the access token in the Authorization header when calling Payblr APIs.

Receive your application credentials

Payblr provisions your client application and provides the credentials required to authenticate. These values are specific to your client and environment.

Your Payblr contact will provide the following values:

Credential	Description
`client_id`	Identifies the client application requesting access to Payblr APIs.
`client_secret`	Confidential value used by the client application to authenticate with the authorization server.
`scope`	Defines the API access permissions assigned to the registered client application.

Treat credentials as confidential. Do not expose the client secret in frontend applications, browser code, screenshots, public repositories, or logs.

Obtain an access token

Use your Client ID, Client Secret, and Scope to request an access token from the Payblr authorization endpoint.

The request uses the OAuth 2.0 Client Credentials grant type.

Example token request

POST [PAYBLR_TOKEN_ENDPOINT]
Content-Type: application/x-www-form-urlencoded

grant_type=client_credentials
&client_id=[YOUR_CLIENT_ID]
&client_secret=[YOUR_CLIENT_SECRET]
&scope=[YOUR_CLIENT_SCOPE]

Example successful response

{
  "access_token": "[ACCESS_TOKEN]",
  "token_type": "Bearer",
  "expires_in": 3600
}

UAT token endpoint

https://login.microsoftonline.com/uat-api-auth.payblr.com/oauth2/v2.0/token

Call Payblr APIs

After obtaining an access token, include it in the Authorization header when calling Payblr APIs.

Example API request pattern

GET [PAYBLR_API_BASE_URL]/[RESOURCE_PATH]
Authorization: Bearer [ACCESS_TOKEN]
Content-Type: application/json

Security notes

Protect client secrets

Do not expose secrets in client-side code, public repositories, logs, screenshots, or shared documents. Use client secrets only in trusted backend systems.

Refresh expired tokens

Access tokens are temporary. When a token expires, request a new one before calling Payblr APIs again.

Next steps

After authentication is working, continue to the API Documentation page to review available endpoints, request fields, response fields, and implementation examples.