Exchange credentials for a token

Exchange your client_key/client_secret pair for a short-lived bearer token used to authenticate against every other partner endpoint.

POSThttps://kicbak.co/api/third-party/v1/auth/token

Authentication

This endpoint itself is unauthenticated — it is how you obtain a token. Your client_key and client_secret go in the JSON body, not headers. Sandbox keys start with tpc_sb_ and reach a separate database.

Request body

Field	Type	Required	Description
client_key	string	required	Your client's public key.
client_secret	string	required	Your client's secret. Shown only once at creation time, so store it securely.

When your secret is rotated

The secret a rotation replaced keeps working for five minutes, so you can deploy the new one without an outage. A token exchanged with the old secret in that window comes back with an expiresAt capped to the window's end; after it closes, such a token is refused everywhere with CREDENTIAL_ROTATED — exchange the new secret and retry.

Code examples

bash

curl -X POST https://kicbak.co/api/third-party/v1/auth/token \
  -H "Content-Type: application/json" \
  -d '{
    "client_key": "YOUR_CLIENT_KEY",
    "client_secret": "YOUR_CLIENT_SECRET"
  }'

Responses

Every response is JSON with a status field (1 success, 0 failure). Failures also carry a code your error handler can branch on — it never changes if we reword message.

json

{
  "status": 1,
  "message": "Token generated successfully",
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "expiresAt": "2026-07-18T12:00:00.000Z"
}

Error reference

Status	Code	Meaning
400	—	Missing client_key or client_secret in the body.
401	—	client_key does not match an active client, or client_secret is wrong ("Invalid credentials").
401	CREDENTIAL_EXPIRED	The credential is past its expiry — a new token cannot be minted; request a new credential.
500	—	Unexpected server error. Safe to retry.
503	MISCONFIGURED	Partner authentication is temporarily unavailable on our side — your credentials are fine. Retry shortly.

Token lifetime

Tokens are valid for 24 hours from issuance (see expiresAt). There is no refresh endpoint — request a new token when yours expires. Use it as Authorization: Bearer <token>.