Merchant tokens let your application accept card-present payments with SumUp SDKs that support token-based authentication. Use them when you want users to sign in to your application with your own authentication, then accept payments for a SumUp merchant account.
Create tokens on your backend using one of the supported authentication methods. Keep your authentication credentials on your backend. Return only the short-lived merchant token to your application and pass its access_token to the SDK.
Before returning a token, authenticate the user in your application and check that they can accept payments for the requested merchant account. A merchant token is limited to that account and the requested actions, and does not grant permissions beyond those of the identity that created it.
Tokens expire 15 minutes after creation. Use expires_in to determine the remaining lifetime and create a new token when needed. This endpoint does not return a refresh token. Treat merchant tokens as secrets: send them over HTTPS and keep them out of URLs, logs, and source code.
Objects:
- Create a merchant tokenPOST
/v0.1/merchants/{merchant_code}/tokensCreates a short-lived token for the merchant account identified by
merchant_codeand the requested actions.Call this endpoint from your backend using a supported authentication method. You must have access to the merchant account. Before returning the token, check that the user signed in to your application is allowed to accept payments for that account.
Pass the returned
access_tokento the SDK. The token expires 15 minutes after creation; useexpires_infor its remaining lifetime. To continue after it expires, create a new token through this endpoint.Required permissions:
{"relation":"tokens.create","object_type":"merchant","object_id_param":"merchant_code"}