Skip to main content

Request an access token

Send your client assertion to the Ryno token endpoint. You get back a Bearer access token for the Partner API.

Sign an assertion

Build a client assertion with a new jti.

Post it to the token endpoint

curl -X POST https://keycloak.sandbox.rynopay.io/realms/ryno/protocol/openid-connect/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d grant_type=client_credentials \
  -d client_id=$RYNO_CLIENT_ID \
  -d client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer \
  -d client_assertion=$ASSERTION \
  -d "scope=partner.read partner.write"

The body is form-encoded, not JSON. The token endpoint is on the identity host, not the API gateway.

Read the token

{
  "access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6...",
  "expires_in": 300,
  "token_type": "Bearer",
  "scope": "partner.read partner.write"
}

Call the API

curl https://gateway.sandbox.rynopay.io/api/partner/v1/business-profiles \
  -H "Authorization: Bearer $ACCESS_TOKEN"

Good to know

Tokens last 5 minutes. Read expires_in rather than hard-coding it.
There is no refresh token. Request a new token with a new assertion. See Token lifecycle.
Ask for the scopes you need. partner.read is always included. Request partner.write to create or update. See Scopes.
A failed request returns 401 invalid_client. See Errors.

The full request and response reference is on Token endpoint.

Good to know