Authentication

Generate Access Token

POST /v1/oauth/token

Exchange your client_id and client_secret for a Bearer access token. The token is valid for 3600 seconds (1 hour).

The response also includes a refresh_token which can be used to obtain a new access token without re-supplying credentials.

Request

Body Parameters

Parameter	Type	Required	Description
`client_id`	string	✅	Your merchant client ID from the HitchPay Dashboard
`client_secret`	string	✅	Your merchant client secret
`grant_type`	string	✅	Must be `client_credentials`

Code Samples

const axios = require("axios");
const qs = require("querystring");

const response = await axios.post(
  "https://sandbox.hitchpay.ng/v1/oauth/token",
  qs.stringify({
    client_id: process.env.CLIENT_ID,
    client_secret: process.env.CLIENT_SECRET,
    grant_type: "client_credentials"
  }),
  {
    headers: {
      "Content-Type": "application/x-www-form-urlencoded"
    }
  }
);

console.log(response.data);

<?php

$ch = curl_init();

curl_setopt_array($ch, [
  CURLOPT_URL => "https://sandbox.hitchpay.ng/v1/oauth/token",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_POST => true,
  CURLOPT_POSTFIELDS => http_build_query([
    "client_id"     => "YOUR_CLIENT_ID",
    "client_secret" => "YOUR_CLIENT_SECRET",
    "grant_type"    => "client_credentials"
  ]),
  CURLOPT_HTTPHEADER => [
    "Content-Type: application/x-www-form-urlencoded"
  ]
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

import requests

url = "https://sandbox.hitchpay.ng/v1/oauth/token"

data = {
    "client_id": "YOUR_CLIENT_ID",
    "client_secret": "YOUR_CLIENT_SECRET",
    "grant_type": "client_credentials"
}

response = requests.post(url, data=data)
print(response.json())

Response

200 — Success

{
  "status": "success",
  "message": "Access token generated successfully",
  "data": {
    "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
    "token_type": "Bearer",
    "expires_in": 3600,
    "refresh_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
  }
}

401 — Invalid Credentials

{
  "status": "error",
  "code": "INVALID_CLIENT",
  "message": "Invalid client credentials"
}

⚠️ Tokens expire after 1 hour. Use the Refresh Access Token endpoint to renew without re-supplying credentials.

Questions? Email [email protected]. Also on GitBook.