Get an access token

POST/realms/ryno/protocol/openid-connect/token

Auth Client assertion

Returns a 5-minute access token for the Partner API. The request goes to the identity host, not the API gateway.

Environment	Host
Sandbox	https://keycloak.sandbox.rynopay.io
Production	https://keycloak.rynopay.io

Body

application/x-www-form-urlencoded. JSON is not accepted.

grant_typestringrequired

client_credentials.

client_idstringrequired

Your client ID from the API Credentials page.

client_assertion_typestringrequired

urn:ietf:params:oauth:client-assertion-type:jwt-bearer.

client_assertionstringrequired

A freshly signed client assertion.

scopestring

Space-separated scopes. partner.read is always granted. Add partner.write to create or update. A scope outside your entitlement profile is not granted. See Scopes.

Response

access_tokenstring

The Bearer token for API calls.

expires_ininteger

Lifetime in seconds, currently 300.

token_typestring

Bearer.

scopestring

The scopes granted.

No refresh token is issued.

Errors

HTTP	error	Cause
401	invalid_client	The assertion is malformed, expired, reused, signed with the wrong key, or has the wrong aud or client ID. The credential may also not be Active.
400	invalid_request	A required form field is missing.

See Troubleshooting.

Request

curl -X POST \
  https://keycloak.sandbox.rynopay.io/realms/ryno/protocol/openid-connect/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d grant_type=client_credentials \
  -d client_id=acme-ltd-d82dc280d10340eca66ad11bc2c3295e \
  -d client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer \
  -d client_assertion=eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9... \
  -d "scope=partner.read partner.write"

Response

200

{
  "access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6...",
  "expires_in": 300,
  "token_type": "Bearer",
  "scope": "partner.read partner.write"
}

401

{
  "error": "invalid_client",
  "error_description": "Invalid client or Invalid client credentials"
}