Token with the client credentials flow

The client credentials flow is one of the authentication and authorization flows available in BTG Id.

This flow differs from the Authorization Code flow in its complexity and in the fact that it can be carried out entirely on the backend.

Generating the token

We will follow the request specification available in Client Credentials. We will start by separating the data we will use and then build the request.

Data

• We separate the endpoint where we will make the request:
  • https://id.btgpactual.com/oauth2/token for production
  • https://id.sandbox.btgpactual.com/oauth2/token for sandbox
• We retrieve our clientId and client secret as shown here
• We base64-encode a string in the format:
  • client_id:client_secret
• We separate the scopes we want to send. Check the product documentation to confirm whether this flow serves your needs.

Request

• We will create a POST request to the endpoint for the environment we are integrating with

• We will send two headers in this request:

  • One with our credentials encoded as instructed in Data: "Authorization: Basic <client_id:client_secret>"
  • One with content-type: application/x-www-form-urlencoded

• We will send in the form:
  • A grant_type field with the value client_credentials
  • A scope field with the scopes of the services you want to integrate, separated by a single space

Response

Done correctly, this request returns an access token able to operate the scopes requested in the scope field.