Authentication

The Regional API uses the OAuth 2.0 protocol to handle requests. To start making calls, you must first generate a temporary access_token. This token, also known as a Bearer Token, must then be included in the header of all subsequent API requests.

Authentication process

The authentication process is a simple, two-step flow:

Request an Access Token using your permanent credentials.
Use the obtained Access Token to make your API calls.

Your Credentials

For each environment (Sandbox and Production), you will be provided with a unique set of credentials. It's important to understand the role of each:

Client ID & Client Secret: These are your permanent credentials used only to generate an access_token.
Seller ID: This is your merchant identifier, which must be passed as a header (x-seller-id) in most API calls to identify your account.

Sandbox credentials are used for testing and development and can be accessed from the developer portal. Production credentials are used for live transactions and will be securely provided by the Getnet team after the homologation process is complete.

Step 1: Generate an Access Token

Your first step is to make a POST request to our token endpoint /auth/oauth/v2/token. You must authenticate this request using HTTP Basic Authentication, passing your Base64-encoded client_id and client_secret.

The following code block shows how to request an access_token and an example of a response. The Authorization header is formed by combining your client_id and client_secret with a colon (:), Base64 encoding the result, and prefixing it with Basic.

json

curl --request POST \
  --url https://api-sbx.globalgetnet.com/authentication/oauth2/access_token \
  --header 'authorization: Basic c2J4XzlmMzQzZWMzLTczNjItNGY2Yi05N2UyLTIzY2FiMjA1M2I3NDo1YTE3MDAyMC05YzMzLTQ1NTUtODM0NC1mZjNiOTY0ZDY0Mzb=' \
  --header 'content-type: application/x-www-form-urlencoded' \
  --data grant_type=client_credentials

json

curl --request POST \
  --url https://api-sbx.globalgetnet.com/authentication/oauth2/access_token \
  --header 'authorization: Basic c2J4XzlmMzQzZWMzLTczNjItNGY2Yi05N2UyLTIzY2FiMjA1M2I3NDo1YTE3MDAyMC05YzMzLTQ1NTUtODM0NC1mZjNiOTY0ZDY0Mzb=' \
  --header 'content-type: application/x-www-form-urlencoded' \
  --data grant_type=client_credentials

The API returns a response with your access token:

json

{
  "access_token": "eyJ0eXAiOiJKV1QiLCJraWQiOiI1amhLMy9xK0ZpK0tTRkIrRUwwN3VhMFYwdGM9IiwiYWxnIjoiUlMyNTYifQ...",
  "scope": "digital-platform-sbx:gateway-api",
  "token_type": "Bearer",
  "expires_in": 3599
}

json

{
  "access_token": "eyJ0eXAiOiJKV1QiLCJraWQiOiI1amhLMy9xK0ZpK0tTRkIrRUwwN3VhMFYwdGM9IiwiYWxnIjoiUlMyNTYifQ...",
  "scope": "digital-platform-sbx:gateway-api",
  "token_type": "Bearer",
  "expires_in": 3599
}

Step 2: Make API Requests

All transactions require a Bearer token generated through OAuth 2.0. You must include this token in the Authorization header of each API request to ensure secure and controlled access.

Include the access token in the Authorization header of your API requests. Use the Bearer authentication scheme. Place the access_token you received in the Authorization header. Prefix it with Bearer.

Authorization header format:

Authorization: Bearer {access_token}

json

curl https://api-sbx.globalgetnet.com/dpm/payments-gwproxy/v2/payments \
  --request POST \
  --header 'Content-Type: application/json' \
  --header 'x-seller-id: YOUR_SELLER_ID' \
  --header 'Authorization: Bearer a1b2c3d4-e5f6-7890-g1h2-i3j4k5l6m7n8'

json

curl https://api-sbx.globalgetnet.com/dpm/payments-gwproxy/v2/payments \
  --request POST \
  --header 'Content-Type: application/json' \
  --header 'x-seller-id: YOUR_SELLER_ID' \
  --header 'Authorization: Bearer a1b2c3d4-e5f6-7890-g1h2-i3j4k5l6m7n8'

Token Management

Access Tokens are temporary and will expire after the time specified in the expires_in field (one hour). Your application should be designed to either request a new token upon expiration or proactively request one before it expires to ensure uninterrupted service.