Authorization

Fetch Auth Token API

Copied !

Merchant backend should call this API to get an auth token, which will be used to authorize the subsequent API calls between the backends of Merchant & PhonePe. Token can be used to make multiple api calls until it expires. Merchant can save the token and rely on the “expires_at” field for the expiry of the token, after which the token can be refreshed using the same API.

Host Details

Environment	Http Method	Value
`SANDBOX`	POST	https://api-preprod.phonepe.com/apis/pg-sandbox
`PROD`	POST	https://api.phonepe.com/apis/identity-manager

API Endpoint

/v1/oauth/token – Endpoint is common for sandbox and production.

Request Details

Copied !

Request Headers

Header Name	Header Value
`Content-Type`	application/x-www-form-urlencoded

Request Parameters

Parameter Name	Description
`client_id`	Client ID shared by PhonePe
`client_version`	In case of UAT, client_version value should be 1. In case of Production, use the value as received in credentials email.
`client_secret`	Client secret shared by PhonePe
`grant_type`	client_credentials

Request Body


{
    "client_id": "<your_client_id>",
    "client_version": 1,
    "client_secret": "<your_client_secret>",
    "grant_type": "client_credentials"
}

NOTE : Above CURL has only the dummy data, please refer to the request headers and parameters table above to generate the payload and headers.

Response Body


{
    "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHBpcmVzT24iOjE3MjA2MzUzMjE5OTYsIm1lcmNoYW50SWQiOiJWUlVBVCJ9.4YjYHI6Gy6gzOisD_628wfbaI46dMSc5T_0gZ2-SAJo",
    "encrypted_access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHBpcmVzT24iOjE3MjA2MzUzMjE5OTYsIm1lcmNoYW50SWQiOiJWUlVBVCJ9.4YjYHI6Gy6gzOisD_628wfbaI46dMSc5T_0gZ2-SAJo",
    "issued_at": 1706073005,
    "expires_at": 1706697605,
    "token_type": "O-Bearer"
}

Response Parameters

Parameter Name	Data Type	Description
`access_token`	String	Token generated at PhonePe, Generated token will remain valid for a specific time and this can be checked by referring to the “expires_at” field. After expiry, the token must be refreshed using the same API.
`issued_at`	DateTime	Token generated timestamp in epoch.
`expires_at`	DateTime	Token expiry timestamp in epoch.
`token_type`	String	Type will be “O-Bearer”.

Note: Merchants should rely on the following response parameters.

access_token – The TOKEN that has be used in the backend API calls from Merchant Server to PhonePe.
expires_at – The validity of the TOKEN