Token endpoint

POSThttps://merchant.shuttleglobal.com/token

Language

Credentials

Client IDClient secret

Remember on this device

Kept in this browser tab unless you tick Remember; don't on a shared computer. Use keys from a sandbox account to test without moving money.

Parameters

Body application/json

cURL request

curl --request POST \
  --url https://merchant.shuttleglobal.com/token \
  --header 'Authorization: Basic <base64 of CLIENT_ID:CLIENT_SECRET>' \
  --header 'Content-Type: application/json' \
  --data '{
  "grant_type": "authorization_code"
}'

const url = 'https://merchant.shuttleglobal.com/token';
const options = {
  method: 'POST',
  headers: {
    Authorization: 'Basic <base64 of CLIENT_ID:CLIENT_SECRET>',
    'Content-Type': 'application/json'
  },
  body: '{"grant_type":"authorization_code"}'
};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

import requests

url = "https://merchant.shuttleglobal.com/token"

payload = { "grant_type": "authorization_code" }
headers = {
    "Authorization": "Basic <base64 of CLIENT_ID:CLIENT_SECRET>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.json())

<?php

$client = new \GuzzleHttp\Client();

$response = $client->request('POST', 'https://merchant.shuttleglobal.com/token', [
  'body' => '{
  "grant_type": "authorization_code"
}',
  'headers' => [
    'Authorization' => 'Basic <base64 of CLIENT_ID:CLIENT_SECRET>',
    'Content-Type' => 'application/json',
  ],
]);

echo $response->getBody();

require 'uri'
require 'net/http'

url = URI("https://merchant.shuttleglobal.com/token")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Basic <base64 of CLIENT_ID:CLIENT_SECRET>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"grant_type\": \"authorization_code\"\n}"

response = http.request(request)
puts response.read_body

package main

import (
  "fmt"
  "strings"
  "net/http"
  "io"
)

func main() {

  url := "https://merchant.shuttleglobal.com/token"

  payload := strings.NewReader("{\n  \"grant_type\": \"authorization_code\"\n}")

  req, _ := http.NewRequest("POST", url, payload)

  req.Header.Add("Authorization", "Basic <base64 of CLIENT_ID:CLIENT_SECRET>")
  req.Header.Add("Content-Type", "application/json")

  res, _ := http.DefaultClient.Do(req)

  defer res.Body.Close()
  body, _ := io.ReadAll(res.Body)

  fmt.Println(res)
  fmt.Println(string(body))

}

Response

Token response

{
  "access_token": "string",
  "expires_in": 3600,
  "refresh_token": "string",
  "token_type": "Bearer"
}

POST

/token

Authenticate your client in one of two ways:

In the request body, with the client_id and client_secret parameters, or
With HTTP Basic authentication, using your client_id as the username and your client_secret as the password

Use one method per request, not both. If you put client_id or client_secret in the body, put both there.

This endpoint supports two use cases:

Authorization Code Exchange:
- Use this when you have received an authorization code from the /authorize flow
- Required parameters: grant_type=authorization_code, code, redirect_uri, plus your client credentials (see above)
- Returns both access_token and refresh_token
- The redirect_uri must match the one used in the original /authorize request
- The authorization code must be exchanged within 15 minutes of being generated
Refresh Token Exchange:
- Use this to get a new access_token when your current one expires
- Required parameters: grant_type=refresh_token, refresh_token, plus your client credentials (see above)
- Returns only access_token (refresh_token remains the same)
- No redirect_uri needed for this flow

Notes:

Access tokens expire after 1 hour (3600 seconds)
Always store refresh_tokens securely - they are long-lived credentials
If a refresh_token becomes compromised, obtain a new authorization code through the /authorize flow

Authorizations

clientAuth
None

Request Body^required

object

client_id

string

Your client ID. Required unless you send it with HTTP Basic authentication.

client_secret

string

Your client secret. Required unless you send it with HTTP Basic authentication.

code

string

Required for authorization_code grant

grant_type

required

string · enum

Allowed values: authorization_code refresh_token

redirect_uri

string · uri

Required for authorization_code grant

refresh_token

string

Required for refresh_token grant

Responses

200

Token response

application/json

object

access_token

required

string

The access token string as issued by the authorization server

expires_in

integer

e.g. 3600

Lifetime of the access token in seconds (RECOMMENDED)

refresh_token

string

Token used to obtain new access tokens using the same authorization grant (OPTIONAL)

token_type

required

string · enum

Type of token (RFC 6749 Section 7.1) MUST be “Bearer” as per RFC 6750

Allowed values: Bearer

Was this page helpful?

Token endpoint

Authorizations

Request Bodyrequired

Responses

200

Request Body^required