Skip to main content

Authentication

PayData uses JWT bearer tokens for authentication and authorization. All HTTP requests must contain a token in the Authorization header:

Authorization: Bearer <Your Token>

If the token is expired or invalid, the API responds with 401 Unauthorized. If the token is valid but missing a scope required for the operation, the API responds with 403 Forbidden.

There are two kinds of tokens — partner tokens (for the main partner and its child-partners) and user tokens (scoped to a single user). See Identity & Access for what each can do and Token Management for how to create and manage them.

Which token types an operation accepts​

Not every operation accepts both token types. Each operation's OpenAPI definition lists which ones are allowed under security — check the API reference for the operation you're calling. GetAccount, for example, accepts either:

"security": [
  { "jwtPartnerToken": ["account:read", "account:all"] },
  { "jwtUserToken": ["account:read", "account:all"] }
]

while GetAccounts (listing every account across all of a partner's users) accepts only a user token — a partner token can manage each user's accounts individually, but can't list them all in one call.