Authorization

Obtain an OAuth 2.0 access token using the client credentials flow. Generate client_id and client_secret from the credentials dashboard, then exchange them for a Bearer token. Token lifetime is configured server-side (TOKEN_TTL_SECONDS; currently 360 seconds / 6 minutes).

Request

POST/api/v1/oauth/token

{{baseUrl}}/api/v1/oauth/token

Header

Header	Type	Description
Content-Type	string	application/json

Body Parameters

Parameter	Type	Description	Required
grant_type	string	Must be "client_credentials"	required
client_id	string	Client ID from the credentials dashboard	required
client_secret	string	Client secret — store server-side only	required

Sample request & response

Sample request body for Sample request & response:

Sample dataSample request body

{
  "grant_type": "client_credentials",
  "client_id": "pel_XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX",
  "client_secret": "skl_XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
}

Sample response for Sample request & response:

200 OKSample dataSample response

{
  "success": true,
  "response_code": 200,
  "message": "Token generated successfully",
  "data": {
    "access_token": "exAmPlEtOkEn0123456789AbCdEfGhIjKlMnOpQrStUvWxYz ......",
    "token_type": "Bearer",
    "expires_in": 360
  },
  "request_id": "550e8400-e29b-41d4-a716-446655440099"
}

Response Fields

Field	Type	Description
success	boolean	Whether the token request succeeded
response_code	number	Application response code (typically mirrors HTTP)
message	string	Human-readable status message
data.access_token	string	Token to send as Bearer on API calls
data.token_type	string	Always "Bearer"
data.expires_in	number	Token lifetime in seconds (360 = 6 minutes)
request_id	string	UUID for support and audit trails

Error codes

Standard Peleza HTTP / response_code values (same across all API calls). Validation message text is endpoint-specific. Full reference: Error Codes.

Code	When
200	Token generated successfully
400	Invalid JSON, or missing grant_type / client_id / client_secret
401	Invalid client_id or client_secret

401 — invalid credentials

401Sample data401 — invalid credentials

{
  "success": false,
  "response_code": 401,
  "message": "Invalid client credentials",
  "data": null,
  "request_id": "550e8400-e29b-41d4-a716-446655440020"
}

Set {{baseUrl}} to https://api.peleza.com (production) or https://sandbox.peleza.com (sandbox). Authenticated calls need a Bearer token from POST /api/v1/oauth/token.