Skip to main content

Getting an access token

Authenticating using OAuth 2.0 and mTLS​

With a certificate issued, you can exchange it for an access token using the OAuth 2.0 client_credentials grant over an mTLS connection.

You'll need:

  • client.key — the private key you generated. Note: it won't be sent. Instead, it'll be used to sign a challenge to prove ownership of client.crt.
  • client.crt — the downloaded certificate bundle.
  • client_id — the OAuth client identifier, shown in the API Integrations section of the Web UI.
note

No client_secret is involved — the mTLS connection itself authenticates you. The server verifies that the certificate presented during the TLS handshake matches the one registered for your OAuth client.

Request​

Call the token endpoint, presenting your certificate and private key:

curl -X POST \
  --url https://business-api.transfergo.com/oauth/v2/oauth-token \
  --cert client.crt \
  --key client.key \
  --header 'Content-Type: application/x-www-form-urlencoded' \
  --data client_id={client_id} \
  --data grant_type=client_credentials \
  --data scope=read

Definition of the endpoint in API Reference.

Response​

A successful response contains the access token:

{
  "access_token": "_0XBPWQQ_a3f1...",
  "token_type": "bearer",
  "expires_in": 300,
  "scope": "read"
}

The token is certificate-bound: it can only be used over a connection established with the same certificate that was presented when the token was issued. Sending it over a different (or no) mTLS connection will be rejected.

note
  • Expiration: tokens are short-lived - 5 minutes.
  • Refresh: there's no refresh token in the client_credentials grant. Request a new one when it expires.
  • Reuse: cache and reuse the token until it expires rather than requesting a new one per call.

Next steps​