Authentication

SAAS Login API

Endpoint: POST {baseUrl}/as/api/v1/saas-login

Payload:

{
  "clientId": "<your_client_id>",
  "clientSecret": "<your_client_secret>"
}

Response:

200 — SUCCESS Response

{
  "accessToken": "...",
  "accessTokenExpiry": "2024-09-23T18:33:10.049+00:00",
  "refreshToken": "...",
  "refreshTokenExpiry": "2024-09-28T08:33:10.047+00:00"
}

Refresh Token API

Endpoint: POST {baseUrl}/as/api/v1/saas-refresh-token

Payload:

{
  "refreshToken": "..."
}

Response:

200 — SUCCESS Response

{
  "data": {
    "accessToken": "...",
    "accessTokenExpiry": "..."
  }
}

Frequently Asked Questions (FAQ)

What is the difference between Access Token and Refresh Token?

Access Token

• It’s like a temporary pass that lets you use an app’s features or access APIs.
• It’s short-lived (e.g., expires in 5–60 minutes).
• Every time you make a request to the server, you send this token to prove you’re allowed to do so.

Example: When you log in to a service, it gives you an access token so you can use it without typing your password again for a while.

Refresh Token

• It’s like a long-term key that can get you a new access token when the old one expires.
• You don’t send it with every request. You keep it safe and only use it to refresh your session.
• It lives much longer (hours, days, or weeks).

Example: When your short pass (access token) expires, you use your longer key (refresh token) to get a new short pass without logging in again.

Recommended Practice

• A valid accessToken is required to call any VaultsPay authenticated API.
• Before making an API request, always verify whether your accessToken is null or expired.
  • If it is expired, then check the status of your refreshToken.
  • If the refreshToken is still valid, use the Refresh Token API to obtain a new accessToken.
• And when your refreshToken has expired (since it has a longer lifespan), call the SaaS Login API to generate a new refreshToken and continue the cycle.