Get API token

POST /token

Try it

Bodyapplication/x-www-form-urlencoded

grant_type*SiteCode*

Request sampleLanguage

curl -X POST 'https://api.ozow.com/token' \
  -H 'ApiKey: YOUR_API_KEY' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -d 'grant_type=string&SiteCode=string'

Response exampleStatus

{
  "access_token": "<access_token>",
  "token_type": "<token_type>",
  "expires_in": "<expires_in>"
}

Built from the response schema. Values are placeholders, not real data.

POSThttps://api.ozow.com/tokenProduction

Build with AI 1 package

A build package is every page for one task, with the API operations they use. Copy the prompt into a coding assistant, or hand it the package itself: slim links to each page, full inlines all of them in one document.

Migrate refunds from the Payments API to One APIEverything needed to move an existing refunds integration onto One API, with the legacy guide and its One API counterpart side by side.
View package

All requests are authenticated using the token you will receive from this request. The same token can be used for all requests until it expires. The only content type supported by this operation is "application/x-www-form-urlencoded".

Authentication

API key in the ApiKey header
The unique API key for the merchant. See Prerequisites and onboarding for where to find it.

Request body

grant_type string required
Set as "Password".
max length50
SiteCode string required
The Ozow site code for the site which the payment is being made to. [Please contact support for SiteCode - support@ozow.com]
max length50

Responses

200 OK

application/json

access_token string required
The token needed for subsequent requests.
max length500
token_type string required
The token type.
max length50
expires_in string required
The lifetime of the token in seconds.
max length50

application/xml

access_token string required
The token needed for subsequent requests.
max length500
token_type string required
The token type.
max length50
expires_in string required
The lifetime of the token in seconds.
max length50

Guides

Refund a paymentIssue a refund on the Payments API, the legacy path. Refunds are merchant-initiated backend operations, funded from your float balance.

Request

curl -X POST 'https://api.ozow.com/token' \
  -H 'ApiKey: YOUR_API_KEY' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -d 'grant_type=%3Cgrant_type%3E&SiteCode=%3CSiteCode%3E'

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Post, "https://api.ozow.com/token");
request.Headers.Add("ApiKey", "YOUR_API_KEY");

request.Content = new StringContent(@"grant_type=%3Cgrant_type%3E&SiteCode=%3CSiteCode%3E", Encoding.UTF8, "application/x-www-form-urlencoded");

var response = await client.SendAsync(request);
var body = await response.Content.ReadAsStringAsync();

<?php
$curl = curl_init();

curl_setopt_array($curl, [
    CURLOPT_URL => 'https://api.ozow.com/token',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_HTTPHEADER => [
        'ApiKey: YOUR_API_KEY',
        'Content-Type: application/x-www-form-urlencoded',
    ],
    CURLOPT_POSTFIELDS => <<<'JSON'
grant_type=%3Cgrant_type%3E&SiteCode=%3CSiteCode%3E
JSON,
]);

$response = curl_exec($curl);
curl_close($curl);

const response = await fetch("https://api.ozow.com/token", {
  method: "POST",
  headers: {
    "ApiKey": "YOUR_API_KEY",
    "Content-Type": "application/x-www-form-urlencoded",
  },
  body: `grant_type=%3Cgrant_type%3E&SiteCode=%3CSiteCode%3E`,
});

const data = await response.json();

import requests

headers = {
    "ApiKey": "YOUR_API_KEY",
    "Content-Type": "application/x-www-form-urlencoded",
}

payload = """grant_type=%3Cgrant_type%3E&SiteCode=%3CSiteCode%3E"""

response = requests.post(
    "https://api.ozow.com/token",
    headers=headers,
    data=payload,
)

Response

{
  "access_token": "<access_token>",
  "token_type": "<token_type>",
  "expires_in": "<expires_in>"
}

Built from the response schema. Values are placeholders, not real data.

Unauthorized. The `ApiKey` header is missing or does not match the site, or for a `Secure` operation the bearer token is missing, expired or invalid.

API key is missing or invalid.