Authentication

The RoxPay API uses Bearer token authentication. Every request must include a valid token in the Authorization header.

Obtaining a Token

Request a token by sending your company credentials to the token endpoint:

curl -X POST https://app.roxpay.eu/api/v4/auth/token \
  -H "Content-Type: application/json" \
  -d '{
    "Email": "your-company-email@example.com",
    "Password": "your-api-password"
  }'

Response

{
  "Message": "Token generated successfully.",
  "StatusCode": 200,
  "Result": true,
  "Token": "eyJhbGciOiJIUzI1NiIs...",
  "RefreshToken": "eyJhbGciOiJIUzI1NiIs...",
  "ExpiresIn": 3600
}

Using the Token

Include the token in every subsequent request:

curl -X POST https://app.roxpay.eu/api/v4/payments/link \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIs..." \
  -H "Content-Type: application/json" \
  -d '{ ... }'

Refreshing Tokens

Tokens expire after the duration specified in ExpiresIn (seconds). Use the refresh endpoint to get a new token without re-authenticating:

curl -X GET https://app.roxpay.eu/api/v4/auth/token/refresh \
  -H "Authorization: Bearer YOUR_REFRESH_TOKEN"

Security Best Practices

• Never expose your API token in client-side code
• Store tokens securely on your server
• Use HTTPS for all API requests
• Rotate your credentials immediately if compromised
• Request separate API credentials for each environment (staging/production)