Start Login

In order to authenticate using credentials, you need a client identifier and a client secret, say:

    Client identifier: Client!234
    Client secret: myPassw0rd

Request

POST /oauth/token HTTP/1.1
Host: connect-testing.secupay-ag.de
Content-Type: application/x-www-form-urlencoded
Cache-Control: no-cache

grant_type=client_credentials&client_id=Client!234&client_secret=myPassw0rd

Response

{
    "access_token": "sqsj9o27ee6nq8opl6h9u32hf0",
    "expires_in": 1200,
    "token_type": "bearer",
    "scope": "https://scope.secucard.com/e/api"
}

This data, like every reply from our servers, is in [JSON](http://www.json.org/) format. Virtually all modern programming languages and frameworks in existence support JSON either natively or through freely available libraries. The most important fields to note here are *expires_in* and *access_token*. You can use your *access_token* for the next *expires_in* seconds, in this case 1200 seconds, or 20 minutes. Before these 20 minutes are up, you need to refresh your token in order to continue using our services.

Errors

400 Bad Request

Error "invalid_client"

Invalid Credentials
{
    "error": "invalid_client",
    "error_description": "The client credentials are invalid"
}
No Credentials transmitted
{
    "error": "invalid_client",
    "error_description": "Client credentials were not found in the headers or body"
}
No client secret transmitted
{
    "error": "invalid_client",
    "error_description": "This client is invalid or must authenticate using a client secret"
}

Error "unsupported_grant_type"

{
    "error": "unsupported_grant_type",
    "error_description": "Grant type \"foo\" not supported"
}

Error "invalid_request"

{
    "error": "invalid_request",
    "error_description": "The grant type was not specified in the request"
}