Authentication

Mises API uses JWT (JSON Web Token) authentication. You need to obtain an access token before making requests to protected endpoints.

Credentials

You will receive two credentials for authentication:

• client_id: Unique identifier for your application
• client_secret: Secret key for authentication

IMPORTANT

Never share your client_secret publicly or include it in code repositories. Treat it like a password.

Generating Access Token

Use the /auth endpoint to generate a JWT token:

Request

POST /auth HTTP/1.1
Host: api.misespay.com
Content-Type: application/json

{
  "client_id": "your_client_id",
  "client_secret": "your_client_secret"
}

Response

{
  "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "token_type": "Bearer",
  "expires_in": 300
}

Response Fields

• access_token: JWT token to use in requests
• token_type: Token type (always "Bearer")
• expires_in: Expiration time in seconds (300 = 5 minutes)

Using the Token

Include the token in the Authorization header of all protected requests:

POST /v1/sales HTTP/1.1
Host: api.misespay.com
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
Content-Type: application/json

Authentication Examples

cURL

curl -X POST https://api.misespay.com/auth \
  -H "Content-Type: application/json" \
  -d '{
    "client_id": "your_client_id",
    "client_secret": "your_client_secret"
  }'

JavaScript (Fetch)

const response = await fetch("https://api.misespay.com/auth", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    client_id: "your_client_id",
    client_secret: "your_client_secret",
  }),
});

const { access_token, expires_in } = await response.json();
console.log("Token:", access_token);
console.log("Expires in:", expires_in, "seconds");

Python (Requests)

import requests

response = requests.post('https://api.misespay.com/auth', json={
    'client_id': 'your_client_id',
    'client_secret': 'your_client_secret'
})

data = response.json()
access_token = data['access_token']
print(f'Token: {access_token}')

Token Renewal

Tokens expire in 5 minutes (300 seconds). When the token expires, you need to generate a new one using the same authentication process.

TIP

Implement an automatic token renewal system before it expires to avoid service interruptions.

Automatic Renewal Example

class MisesAuth {
  constructor(clientId, clientSecret) {
    this.clientId = clientId;
    this.clientSecret = clientSecret;
    this.token = null;
    this.expiresAt = null;
  }

  async getToken() {
    // Check if token is still valid
    if (this.token && this.expiresAt > Date.now()) {
      return this.token;
    }

    // Generate new token
    const response = await fetch("https://api.misespay.com/auth", {
      method: "POST",
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify({
        client_id: this.clientId,
        client_secret: this.clientSecret,
      }),
    });

    const data = await response.json();
    this.token = data.access_token;
    this.expiresAt = Date.now() + data.expires_in * 1000;

    return this.token;
  }
}

// Usage
const auth = new MisesAuth("your_client_id", "your_client_secret");
const token = await auth.getToken();

Environment Variables

Store your credentials in environment variables:

# .env
MISES_CLIENT_ID=your_client_id
MISES_CLIENT_SECRET=your_client_secret

// Accessing in code
const clientId = process.env.MISES_CLIENT_ID;
const clientSecret = process.env.MISES_CLIENT_SECRET;

Authentication Errors

401 Unauthorized

Invalid credentials or expired token:

{
  "error": "Unauthorized",
  "message": "Invalid credentials"
}

400 Bad Request

Missing required fields:

{
  "error": "Bad Request",
  "message": "client_id and client_secret are required"
}

Security

• ✅ Use HTTPS for all requests
• ✅ Store credentials in environment variables
• ✅ Never expose client_secret in frontend code
• ✅ Renew token before it expires
• ✅ Implement rate limiting on your side
• ❌ Never commit credentials to Git repositories
• ❌ Never share your client_secret

Next Steps

• Create Sale - Sales endpoint documentation