curl --request POST \
--url https://sandbox-api.va.meridianpay.com/v1/auth/token \
--header 'Content-Type: application/json' \
--header 'X-Meridian-Api-Key: <x-meridian-api-key>' \
--header 'X-Meridian-Program-Id: <x-meridian-program-id>' \
--header 'X-Meridian-Signature: <api-key>' \
--header 'X-Meridian-Timestamp: <x-meridian-timestamp>' \
--data '{}'import requests
url = "https://sandbox-api.va.meridianpay.com/v1/auth/token"
payload = {}
headers = {
"X-Meridian-Api-Key": "<x-meridian-api-key>",
"X-Meridian-Timestamp": "<x-meridian-timestamp>",
"X-Meridian-Program-Id": "<x-meridian-program-id>",
"X-Meridian-Signature": "<api-key>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {
'X-Meridian-Api-Key': '<x-meridian-api-key>',
'X-Meridian-Timestamp': '<x-meridian-timestamp>',
'X-Meridian-Program-Id': '<x-meridian-program-id>',
'X-Meridian-Signature': '<api-key>',
'Content-Type': 'application/json'
},
body: JSON.stringify({})
};
fetch('https://sandbox-api.va.meridianpay.com/v1/auth/token', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://sandbox-api.va.meridianpay.com/v1/auth/token",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json",
"X-Meridian-Api-Key: <x-meridian-api-key>",
"X-Meridian-Program-Id: <x-meridian-program-id>",
"X-Meridian-Signature: <api-key>",
"X-Meridian-Timestamp: <x-meridian-timestamp>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://sandbox-api.va.meridianpay.com/v1/auth/token"
payload := strings.NewReader("{}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("X-Meridian-Api-Key", "<x-meridian-api-key>")
req.Header.Add("X-Meridian-Timestamp", "<x-meridian-timestamp>")
req.Header.Add("X-Meridian-Program-Id", "<x-meridian-program-id>")
req.Header.Add("X-Meridian-Signature", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://sandbox-api.va.meridianpay.com/v1/auth/token")
.header("X-Meridian-Api-Key", "<x-meridian-api-key>")
.header("X-Meridian-Timestamp", "<x-meridian-timestamp>")
.header("X-Meridian-Program-Id", "<x-meridian-program-id>")
.header("X-Meridian-Signature", "<api-key>")
.header("Content-Type", "application/json")
.body("{}")
.asString();require 'uri'
require 'net/http'
url = URI("https://sandbox-api.va.meridianpay.com/v1/auth/token")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["X-Meridian-Api-Key"] = '<x-meridian-api-key>'
request["X-Meridian-Timestamp"] = '<x-meridian-timestamp>'
request["X-Meridian-Program-Id"] = '<x-meridian-program-id>'
request["X-Meridian-Signature"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{}"
response = http.request(request)
puts response.read_body{
"access_token": "access_token_abc123",
"expires_in": 3600,
"token_type": "Bearer",
"refresh_token": "refresh_token_abc123",
"scope": "enrollment:get enrollment:activate",
"issued_token_type": "urn:ietf:params:oauth:token-type:access_token"
}{
"message": "<string>",
"validationErrors": [
{
"fieldRef": "<string>",
"type": "InvalidFormat",
"message": "<string>"
}
],
"errorCode": "UNAUTHORIZED"
}{
"message": "<string>",
"validationErrors": [
{
"fieldRef": "<string>",
"type": "InvalidFormat",
"message": "<string>"
}
],
"errorCode": "UNAUTHORIZED"
}{
"message": "<string>",
"validationErrors": [
{
"fieldRef": "<string>",
"type": "InvalidFormat",
"message": "<string>"
}
],
"errorCode": "UNAUTHORIZED"
}{
"message": "<string>",
"validationErrors": [
{
"fieldRef": "<string>",
"type": "InvalidFormat",
"message": "<string>"
}
],
"errorCode": "UNAUTHORIZED"
}{
"message": "<string>",
"validationErrors": [
{
"fieldRef": "<string>",
"type": "InvalidFormat",
"message": "<string>"
}
],
"errorCode": "UNAUTHORIZED"
}Issue a Meridian Accounts access token
Mints a JWT for a Meridian user. For client_credentials grants, the user is identified by the X-Meridian-User-Id header: it must be provided for MULTI_USER integrations and omitted for SINGLE_USER integrations (the single configured user is used). For refresh_token grants, the user is derived from the supplied refresh token.
curl --request POST \
--url https://sandbox-api.va.meridianpay.com/v1/auth/token \
--header 'Content-Type: application/json' \
--header 'X-Meridian-Api-Key: <x-meridian-api-key>' \
--header 'X-Meridian-Program-Id: <x-meridian-program-id>' \
--header 'X-Meridian-Signature: <api-key>' \
--header 'X-Meridian-Timestamp: <x-meridian-timestamp>' \
--data '{}'import requests
url = "https://sandbox-api.va.meridianpay.com/v1/auth/token"
payload = {}
headers = {
"X-Meridian-Api-Key": "<x-meridian-api-key>",
"X-Meridian-Timestamp": "<x-meridian-timestamp>",
"X-Meridian-Program-Id": "<x-meridian-program-id>",
"X-Meridian-Signature": "<api-key>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {
'X-Meridian-Api-Key': '<x-meridian-api-key>',
'X-Meridian-Timestamp': '<x-meridian-timestamp>',
'X-Meridian-Program-Id': '<x-meridian-program-id>',
'X-Meridian-Signature': '<api-key>',
'Content-Type': 'application/json'
},
body: JSON.stringify({})
};
fetch('https://sandbox-api.va.meridianpay.com/v1/auth/token', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://sandbox-api.va.meridianpay.com/v1/auth/token",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json",
"X-Meridian-Api-Key: <x-meridian-api-key>",
"X-Meridian-Program-Id: <x-meridian-program-id>",
"X-Meridian-Signature: <api-key>",
"X-Meridian-Timestamp: <x-meridian-timestamp>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://sandbox-api.va.meridianpay.com/v1/auth/token"
payload := strings.NewReader("{}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("X-Meridian-Api-Key", "<x-meridian-api-key>")
req.Header.Add("X-Meridian-Timestamp", "<x-meridian-timestamp>")
req.Header.Add("X-Meridian-Program-Id", "<x-meridian-program-id>")
req.Header.Add("X-Meridian-Signature", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://sandbox-api.va.meridianpay.com/v1/auth/token")
.header("X-Meridian-Api-Key", "<x-meridian-api-key>")
.header("X-Meridian-Timestamp", "<x-meridian-timestamp>")
.header("X-Meridian-Program-Id", "<x-meridian-program-id>")
.header("X-Meridian-Signature", "<api-key>")
.header("Content-Type", "application/json")
.body("{}")
.asString();require 'uri'
require 'net/http'
url = URI("https://sandbox-api.va.meridianpay.com/v1/auth/token")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["X-Meridian-Api-Key"] = '<x-meridian-api-key>'
request["X-Meridian-Timestamp"] = '<x-meridian-timestamp>'
request["X-Meridian-Program-Id"] = '<x-meridian-program-id>'
request["X-Meridian-Signature"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{}"
response = http.request(request)
puts response.read_body{
"access_token": "access_token_abc123",
"expires_in": 3600,
"token_type": "Bearer",
"refresh_token": "refresh_token_abc123",
"scope": "enrollment:get enrollment:activate",
"issued_token_type": "urn:ietf:params:oauth:token-type:access_token"
}{
"message": "<string>",
"validationErrors": [
{
"fieldRef": "<string>",
"type": "InvalidFormat",
"message": "<string>"
}
],
"errorCode": "UNAUTHORIZED"
}{
"message": "<string>",
"validationErrors": [
{
"fieldRef": "<string>",
"type": "InvalidFormat",
"message": "<string>"
}
],
"errorCode": "UNAUTHORIZED"
}{
"message": "<string>",
"validationErrors": [
{
"fieldRef": "<string>",
"type": "InvalidFormat",
"message": "<string>"
}
],
"errorCode": "UNAUTHORIZED"
}{
"message": "<string>",
"validationErrors": [
{
"fieldRef": "<string>",
"type": "InvalidFormat",
"message": "<string>"
}
],
"errorCode": "UNAUTHORIZED"
}{
"message": "<string>",
"validationErrors": [
{
"fieldRef": "<string>",
"type": "InvalidFormat",
"message": "<string>"
}
],
"errorCode": "UNAUTHORIZED"
}Authorizations
Meridian HMAC header authentication, for server-to-server calls.
Required headers:
X-Meridian-Api-KeyX-Meridian-TimestampX-Meridian-Program-IdX-Meridian-User-Id(MULTI_USER integrations only)X-Meridian-Signature
X-Meridian-Signature is the HMAC SHA-256 signature of the canonical request string, computed per request. See Authentication for how to construct it.
Headers
Server-to-server (HMAC) requests only. Partner API key issued by Meridian during provisioning.
Server-to-server (HMAC) requests only. Current time in milliseconds since the Unix epoch. Must be within 60 seconds of the request.
Server-to-server (HMAC) requests only. Identifies the program context for the request.
Server-to-server (HMAC) requests only. Identifies the Meridian user targeted by the request. Required for MULTI_USER integrations; omit for SINGLE_USER.
Body
Either a client_credentials or refresh_token grant payload
- Client Credentials Token Body
- Refresh Token Body
Token request payload for the client_credentials grant
OAuth grant type
client_credentials, refresh_token Response
The issued access and refresh tokens
OAuth token response for Meridian Accounts authentication
Bearer access token
"access_token_abc123"
Lifetime of the access token in seconds
3600
Type of token returned
"Bearer"
Refresh token that can be exchanged for a new access token
"refresh_token_abc123"
Space-delimited scopes granted to the access token
"enrollment:get enrollment:activate"
URN describing the type of issued token
"urn:ietf:params:oauth:token-type:access_token"