Skip to content

Authentication

Access tokens for sending events to BravoTran with OAuth 2.0.

Operations

Request an access token from BravoTran

Request

This endpoint is hosted by BravoTran, not the partner. Needed only if you authenticate to POST /events with OAuth 2.0 instead of an API token.

Exchanges your OAuth client credentials for an access token using the client credentials grant. Authenticate with one of:

  • Client ID and client secret — HTTP Basic authentication (the Authorization header), or client_id and client_secret form fields.
  • Certificate — client_assertion_type and client_assertion form fields, with a JWT signed by your private key.

Client credentials in the query string are rejected. See Authentication for setup and the JWT requirements.

Send the returned access_token to POST /events as Authorization: Bearer <access_token>.

Bodyapplication/x-www-form-urlencodedrequired
One of:

Send client_id and client_secret here, or omit them and use HTTP Basic authentication instead — not both.

grant_typestringrequired
Value:"client_credentials"
client_idstring

Your client ID. Omit when using HTTP Basic authentication.

client_secretstring

Your client secret. Omit when using HTTP Basic authentication.

scopestring

Optional. Returned unchanged in the response.

curl -i -X POST \
  https://apidocs.bravotran.com/_mock/openapi/oauth/token \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  --data-urlencode grant_type=client_credentials \
  --data-urlencode client_id=7f2d55ad-bc27-4b50-8df8-f0432c05a0ee \
  --data-urlencode client_secret=your-client-secret

Responses

Access token issued

Headers
Cache-Controlstring

Always no-store.

Bodyapplication/json
access_tokenstringrequired

Send as Authorization: Bearer <access_token> to POST /events.

token_typestringrequired
Value:"Bearer"
expires_inintegerrequired

Seconds until the access token expires.

scopestring or null

The scope sent in the request, or null.

Response
{
  "access_token": "eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiI3ZjJkNTVhZC1iYzI3In0.signature",
  "token_type": "Bearer",
  "expires_in": 3600,
  "scope": null
}