Authentication

The Swypex Partner API uses the OAuth 2.0 Client Credentials flow for server-to-server authentication.

Get API credentials

Request credentials from your Swypex representative. You receive a client ID and a client secret.

Store the client secret in a secrets manager. Swypex does not retain a recoverable copy of the secret, but your representative can rotate it when needed.

Never embed client credentials in browser or mobile code, commit them to source control, or include them in logs.

Available scopes

Request the scopes your integration needs.

Name
cards:read
Description
List cards and retrieve card details.
Name
cards:write
Description
Set and update card limits.
Name
transactions:read
Description
List and retrieve transactions.

Obtain an access token

Send a form-encoded request to https://p.swypex.com/v1/oauth/token.

cURL

curl -X POST https://p.swypex.com/v1/oauth/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  --data-urlencode "grant_type=client_credentials" \
  --data-urlencode "client_id={client_id}" \
  --data-urlencode "client_secret={client_secret}" \
  --data-urlencode "scope=cards:read cards:write transactions:read"

JavaScript

const response = await fetch('https://p.swypex.com/v1/oauth/token', {
  method: 'POST',
  headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
  body: new URLSearchParams({
    grant_type: 'client_credentials',
    client_id: process.env.SWYPEX_CLIENT_ID,
    client_secret: process.env.SWYPEX_CLIENT_SECRET,
    scope: 'cards:read cards:write transactions:read',
  }),
})

if (!response.ok) {
  throw new Error(`Token request failed with status ${response.status}`)
}

const { access_token: accessToken } = await response.json()

The token response includes the granted scopes and expiration in seconds.

Response

{
  "access_token": "eyJhbGciOi...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "scope": "cards:read cards:write transactions:read"
}

Authenticate API requests

Pass the token using the Bearer authentication scheme.

Request

curl https://p.swypex.com/v1/card \
  -H "Authorization: Bearer {access_token}"

When a token expires, request a new one using the same client-credentials flow. There is no refresh-token step.

Security practices

Keep credentials and access tokens server-side.
Request only the scopes required by the integration.
Rotate secrets regularly and immediately after suspected exposure.
Redact authorization headers, client secrets, and response data from logs.
Validate token-request errors without exposing credential values.