Get Merchant Access Token

curl --request POST \
  --url https://api-sandbox.revolv3.com/api/Authentication/token \
  --header 'Content-Type: application/json-patch+json' \
  --data '
{
  "clientId": "clientIdentifier",
  "clientSecret": "clientSecret"
}
'

import requests

url = "https://api-sandbox.revolv3.com/api/Authentication/token"

payload = {
    "clientId": "clientIdentifier",
    "clientSecret": "clientSecret"
}
headers = {"Content-Type": "application/json-patch+json"}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {'Content-Type': 'application/json-patch+json'},
  body: JSON.stringify({clientId: 'clientIdentifier', clientSecret: 'clientSecret'})
};

fetch('https://api-sandbox.revolv3.com/api/Authentication/token', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api-sandbox.revolv3.com/api/Authentication/token",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'clientId' => 'clientIdentifier',
    'clientSecret' => 'clientSecret'
  ]),
  CURLOPT_HTTPHEADER => [
    "Content-Type: application/json-patch+json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api-sandbox.revolv3.com/api/Authentication/token"

	payload := strings.NewReader("{\n  \"clientId\": \"clientIdentifier\",\n  \"clientSecret\": \"clientSecret\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Content-Type", "application/json-patch+json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api-sandbox.revolv3.com/api/Authentication/token")
  .header("Content-Type", "application/json-patch+json")
  .body("{\n  \"clientId\": \"clientIdentifier\",\n  \"clientSecret\": \"clientSecret\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api-sandbox.revolv3.com/api/Authentication/token")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Content-Type"] = 'application/json-patch+json'
request.body = "{\n  \"clientId\": \"clientIdentifier\",\n  \"clientSecret\": \"clientSecret\"\n}"

response = http.request(request)
puts response.read_body

{
  "token_type": "Bearer",
  "expires_in": 3599,
  "ext_expires_in": 3599,
  "access_token": "thisisagianttokenhash1NiIsImtpZCI6IlNzWnNCTmhaY0YzUTlTNHRycFFCVEJ5TlthisisagianttokenhashTQ0MTMiLCJpc3MiOiJodHRwczovL2xvZ2luLm1pY3Jvc29mdG9ubGluZS5jb20vZjAyMzQ1MDEtMjdkZC00NTY1LWI1NDUtNDBlZDFmZjNjZDU1L3YyLjAiLCJpYXQiOjE1OTEyODthisisagianttokenhashhwIjoxNTkxMjkzODYzLCJhaW8iOiI0MmRnWURBTDhGTU5iNUgwOGF4thisisagianttokenhashYmExN2VkLTExMGMtNDVmthisisagianttokenhashmF6cGFjciI6IjEiLCJ0aWQiOiJmMDIzNDUwMS0yN2RkLTQ1NjUtYjU0NS00MGVkMWZmM2NkNTUiLCJ1dGkiOiJWOEhIbXVfZ1RVZUZQQ0pKNF91b0FBIiwidmVyIjoiMi4wIn0.rrQVOMQ2M3xhBeA96fOeidrghJep_DEC0-y-WTlsZu37rO18FgTBAp-tNeMasrLZlEcP6O2Ij8OqxY8yqxmIaPoaXpH9f8DN6nkthisisagianttokenhashlCDGp6zUdEb0XDA2-JXbSbs918g9DPBjuTDio1-Cithisisagianttokenhash8C4-H1XZfRN4Z7IMthisisagianttokenhashxp8lqK66NrXI2RtihtBs6gI3GKpfhok-H6_NvUaQQthisisagianttokenhashOHlKrKQ6D2fUIcXg",
  "isExpired": false,
  "expirationTime": "2026-07-01T11:31:37.682237Z"
}

Authentication

Get Merchant Access Token

Generates an access token used to authenticate API requests on behalf of a specific merchant. This endpoint is typically called as part of the login or credential exchange process and requires valid client credentials (Merchant Client ID, Developer API Key), which can be generated in the Merchant Settings Profile page. The returned token should be included in the Authorization header of subsequent requests to secure endpoints. Access tokens are time-limited and may need to be refreshed once a year.

Related Links:

Merchant Access Token

POST

api

Authentication

token

Get Merchant Access Token

curl --request POST \
  --url https://api-sandbox.revolv3.com/api/Authentication/token \
  --header 'Content-Type: application/json-patch+json' \
  --data '
{
  "clientId": "clientIdentifier",
  "clientSecret": "clientSecret"
}
'

import requests

url = "https://api-sandbox.revolv3.com/api/Authentication/token"

payload = {
    "clientId": "clientIdentifier",
    "clientSecret": "clientSecret"
}
headers = {"Content-Type": "application/json-patch+json"}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {'Content-Type': 'application/json-patch+json'},
  body: JSON.stringify({clientId: 'clientIdentifier', clientSecret: 'clientSecret'})
};

fetch('https://api-sandbox.revolv3.com/api/Authentication/token', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api-sandbox.revolv3.com/api/Authentication/token",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'clientId' => 'clientIdentifier',
    'clientSecret' => 'clientSecret'
  ]),
  CURLOPT_HTTPHEADER => [
    "Content-Type: application/json-patch+json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api-sandbox.revolv3.com/api/Authentication/token"

	payload := strings.NewReader("{\n  \"clientId\": \"clientIdentifier\",\n  \"clientSecret\": \"clientSecret\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Content-Type", "application/json-patch+json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api-sandbox.revolv3.com/api/Authentication/token")
  .header("Content-Type", "application/json-patch+json")
  .body("{\n  \"clientId\": \"clientIdentifier\",\n  \"clientSecret\": \"clientSecret\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api-sandbox.revolv3.com/api/Authentication/token")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Content-Type"] = 'application/json-patch+json'
request.body = "{\n  \"clientId\": \"clientIdentifier\",\n  \"clientSecret\": \"clientSecret\"\n}"

response = http.request(request)
puts response.read_body

{
  "token_type": "Bearer",
  "expires_in": 3599,
  "ext_expires_in": 3599,
  "access_token": "thisisagianttokenhash1NiIsImtpZCI6IlNzWnNCTmhaY0YzUTlTNHRycFFCVEJ5TlthisisagianttokenhashTQ0MTMiLCJpc3MiOiJodHRwczovL2xvZ2luLm1pY3Jvc29mdG9ubGluZS5jb20vZjAyMzQ1MDEtMjdkZC00NTY1LWI1NDUtNDBlZDFmZjNjZDU1L3YyLjAiLCJpYXQiOjE1OTEyODthisisagianttokenhashhwIjoxNTkxMjkzODYzLCJhaW8iOiI0MmRnWURBTDhGTU5iNUgwOGF4thisisagianttokenhashYmExN2VkLTExMGMtNDVmthisisagianttokenhashmF6cGFjciI6IjEiLCJ0aWQiOiJmMDIzNDUwMS0yN2RkLTQ1NjUtYjU0NS00MGVkMWZmM2NkNTUiLCJ1dGkiOiJWOEhIbXVfZ1RVZUZQQ0pKNF91b0FBIiwidmVyIjoiMi4wIn0.rrQVOMQ2M3xhBeA96fOeidrghJep_DEC0-y-WTlsZu37rO18FgTBAp-tNeMasrLZlEcP6O2Ij8OqxY8yqxmIaPoaXpH9f8DN6nkthisisagianttokenhashlCDGp6zUdEb0XDA2-JXbSbs918g9DPBjuTDio1-Cithisisagianttokenhash8C4-H1XZfRN4Z7IMthisisagianttokenhashxp8lqK66NrXI2RtihtBs6gI3GKpfhok-H6_NvUaQQthisisagianttokenhashOHlKrKQ6D2fUIcXg",
  "isExpired": false,
  "expirationTime": "2026-07-01T11:31:37.682237Z"
}

Body

clientId

string

required

The client unique merchant identifier for authentication.

Required string length: 1 - 500

clientSecret

string

required

The merchant's secret used to verify their identity.

Required string length: 1 - 500

Response

The credentials provided were valid, and a new access token has been successfully obtained.

token_type

string

The token type, returns only Bearer.

expires_in

integer<int32>

The remaining lifetime of the access token in seconds.

ext_expires_in

integer<int32>

The remaining lifetime of the access token in seconds.

access_token

string

JWT token that must be included in the Authorization header.

isExpired

boolean

read-only

Whether the token expired or not.

expirationTime

string<YYYY-MM-DDThh:mm:ss>

A timestamp expressed in UTC, indicating the exact moment the access token will expire.

Validate corporate ACH account Create Checkout Link

⌘I

AccountVerification

Authentication

Checkout

Customers

Invoices

PaymentMethod

Payments

Subscriptions

Get Merchant Access Token

Body

Response