Generate Token.

Paymish Docs

Generate Token.

Paymish
API Auth

Endpoint Overview

POST /api/user-service/external/v1/generate-token

Purpose

Use this endpoint to generate token. It belongs to the API Auth collection and is designed for backend integrations.

Request shape

0 parameters and 2 documented body fields using application/json.

Implementation Guide

Recommended workflow

Validate the input data, identifiers, and account state in your application before making the request.

Send the POST request from your backend using the required headers and the expected content type (application/json).

Persist the important identifiers returned in the response so later lookups, webhooks, or support actions can be linked correctly.

Implementation notes

Validate the request payload on your backend before sending it, especially the 2 documented body fields.
Protect state-changing operations with strong validation, logging, and retry rules to avoid duplicate mutations.

Request Body

Content type: application/json

public_key required

string

No description provided.

secret_key required

string

No description provided.

Responses

200 API login

400 Bad request

Expected Outcomes

API login

{
  "status": "success",
  "message": "Authentication successful",
  "data": {
    "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
    "expires_in": 3600
  }
}

Bad request

{
  "status": "error",
  "message": "Invalid credentials supplied.",
  "errors": {
    "credentials": [
      "Check the secret key, partner code, and target environment."
    ]
  }
}

After the response:

Confirm the request is coming from backend-only code and that the correct environment secret is being used.
Refresh or rotate the stored auth state if credentials changed recently.
Only retry after correcting the credential or token lifecycle issue; repeated blind retries will not resolve auth failures.

Language Notes

Python

Use `requests` from a backend worker, service, or Django/Flask app and centralize headers in a reusable helper.

Node.js

Use `axios` or `fetch` from Node.js services only; do not place secret credentials in frontend bundles.

PHP

Wrap cURL usage in a small client class so auth headers, error handling, and logging stay consistent.

cURL

Use cURL for smoke testing and debugging, then move the final logic into your backend service code.

Code Examples

import requests

headers = {
    "Content-Type": "application/json",
}
payload = {
  "public_key": "value",
  "secret_key": "value"
}

response = requests.post(
    "https://api.paymish.com/api/user-service/external/v1/generate-token",
    headers=headers,
    json=payload,
)

data = response.json()
print(data)

const axios = require("axios");

const response = await axios({
  method: "post",
  url: "https://api.paymish.com/api/user-service/external/v1/generate-token",
  headers: {
    "Content-Type": "application/json",
  },
  data: {
  "public_key": "value",
  "secret_key": "value"
}
});

console.log(response.data);

curl https://api.paymish.com/api/user-service/external/v1/generate-token \
  -X POST \
  -H "Content-Type: application/json" \
  -d '{   "public_key": "value",   "secret_key": "value" }'

<?php
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, "https://api.paymish.com/api/user-service/external/v1/generate-token");
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, "POST");
curl_setopt($ch, CURLOPT_HTTPHEADER, [
    "Content-Type: application/json",
]);
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode([
    "public_key" => "value",
    "secret_key" => "value",
]));

$response = curl_exec($ch);
curl_close($ch);
$data = json_decode($response, true);
print_r($data);

Next endpoint Create a dispute by uploading a document.