Application Authentication
How to authenticate with the Pinch API
The Pinch API uses OAuth 2.0 client credentials for authentication. Every API request requires a Bearer token, which you obtain by exchanging your Application ID and Secret Key.
Merchant ID is deprecated. If you've seen references to using your Merchant ID as aclient_id, that approach is no longer supported and should not be used in new integrations. Always authenticate using an Application.
Your credentials can be found in the API Keys section of the Developer Portal.
Getting a token
Make a POST request to the token endpoint with your credentials using HTTP Basic Auth:
POST https://auth.getpinch.com.au/connect/token
Authorization: Basic <base64(client_id:client_secret)>
Content-Type: application/x-www-form-urlencoded
grant_type=client_credentialsOr equivalently with explicit credentials in the body:
POST https://auth.getpinch.com.au/connect/token
Content-Type: application/x-www-form-urlencoded
grant_type=client_credentials&client_id=YOUR_APPLICATION_ID&client_secret=YOUR_SECRET_KEYResponse:
{
"access_token": "eyJhbGci...",
"expires_in": 3600,
"token_type": "Bearer"
}Using the token
Include the token in the Authorization header of every API request:
Authorization: Bearer eyJhbGci...Tokens expire after 1 hour. Cache and reuse your token; don’t request a new one on every API call.
Application Authentication (Merchant ID is deprecated)
Authentication via Merchant ID and Secret Key is deprecated and should not be used in new integrations. Always use an Application as your client_id.
Applications provide several advantages over the old Merchant ID approach:
- Improved visibility: see exactly which application created a payment or payer record.
- Scoped access: applications can be restricted to specific permissions.
- Multi-merchant consent: future support for merchants granting integrations access without sharing their raw API keys.
You can create and manage Applications in the API Keys section of the portal.
If you’re using the .NET SDK, authentication is handled automatically; just pass your Application ID and Secret Key when initialising the client.
What to do next
Once you can successfully fetch a token, follow the guide for your payment type:
Updated 5 days ago