Skip to main content
POST
/
oauth
/
token
Create Auth Token to Initialise the SDK
curl --request POST \
  --url https://sandbox.cashfree.com/verification/oauth/token \
  --header 'Content-Type: application/json' \
  --header 'x-api-version: <x-api-version>' \
  --header 'x-client-id: <api-key>' \
  --header 'x-client-secret: <api-key>' \
  --data '{
  "app_id": "app_id_for_vkyc",
  "product": "VKYC",
  "metadata": {
    "vkyc_request_id": 249749
  },
  "authenticated_user": {
    "identifier_type": "userId",
    "identifier_value": 123456
  }
}'
{
  "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c",
  "expires_at": "2024-02-02 17:30:00 IST"
}

Authorizations

ā€‹
x-client-id
string
header
required

Your unique client identifier issued by Cashfree. You can find this in your Merchant Dashboard.

ā€‹
x-client-secret
string
header
required

The secret key associated with your client ID. Use this to authenticate your API requests. You can find this in your Merchant Dashboard.

Headers

ā€‹
x-cf-signature
string

Send the signature if two-factor authentication is selected as Public Key. More details

ā€‹
x-api-version
string
default:2024-12-01
required

API version to be used. Format is in YYYY-MM-DD.

Example:

"2024-12-01"

Body

application/json

Request payload for create auth token to initialise the SDK.

ā€‹
app_id
string
required

It is the unique identifier for the OAuth application. This is used to authenticate and authorize the application making the request. Note: Please contact your Account Manager to create an app_id for the VKYC product. In the future, this will be self-serve via the Merchant Dashboard.

Example:

"app_id_for_vkyc"

ā€‹
product
string
required

The product for which the authentication token is generated. In this case, it should be "VKYC".

Example:

"VKYC"

ā€‹
metadata
object
required

The metadata associated with the authentication token.

ā€‹
authenticated_user
object
required

The identifier of the authenticated user.

Response

Success response for generating an authentication token required to initialize the SDK.

ā€‹
expiry
string

The timestamp (in IST) when the token will expire. A new token must be generated after this time.

Example:

"2025-05-05T18:01:05+05:30"

ā€‹
access_token
string

The generated access token to be used for subsequent VKYC API calls.

Example:

"mH5tVmtwod4J9GhCXwTuygd2zRZn4pj5"