Evyoo POS API v1

Get an access token

Get an access token

Exchange your access key and security code for a token valid for 15 minutes (OAuth 2.0 client credentials).

Each successful call creates a new token and the previous ones stay valid until they expire: keep your token and reuse it, and ask for a new one only after a 401. Limit: 10 token requests per minute per IP address. After repeated failures the client is blocked for 15 minutes.

All errors on this route use the OAuth format: {"error": "...", "error_description": "..."}.

no token needed Getting started

Endpoint#

POST/api/v1/auth/token

Example request#

bash
curl -X POST "https://votre-entreprise.evyooht.com/api/v1/auth/token" \
  -d "grant_type=client_credentials" \
  -d "client_id=evy_ak_votre_cle" \
  -d "client_secret=evy_sk_votre_code"
powershell
$body = @{
    grant_type = "client_credentials"
    client_id = "evy_ak_votre_cle"
    client_secret = "evy_sk_votre_code"
}
Invoke-RestMethod -Method Post -Uri "https://votre-entreprise.evyooht.com/api/v1/auth/token" -Body $body
javascript
const response = await fetch("https://votre-entreprise.evyooht.com/api/v1/auth/token", {
  method: "POST",
  body: new URLSearchParams({
    grant_type: "client_credentials",
    client_id: "evy_ak_votre_cle",
    client_secret: "evy_sk_votre_code",
  }),
});
const data = await response.json();
console.log(data);
php
$ch = curl_init("https://votre-entreprise.evyooht.com/api/v1/auth/token");
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_POST => true,
    CURLOPT_POSTFIELDS => http_build_query([
        "grant_type" => "client_credentials",
        "client_id" => "evy_ak_votre_cle",
        "client_secret" => "evy_sk_votre_code",
    ]),
]);
$data = json_decode(curl_exec($ch), true);
curl_close($ch);
print_r($data);
python
import requests

response = requests.post(
    "https://votre-entreprise.evyooht.com/api/v1/auth/token",
    data={"grant_type": "client_credentials", "client_id": "evy_ak_votre_cle", "client_secret": "evy_sk_votre_code"},
)
print(response.json())

Request body#

Send it as a form (application/x-www-form-urlencoded) or as JSON.

FieldTypeDescription
grant_type"client_credentials"Always client_credentials.
client_idstringYour access key (starts with evy_ak_).
client_secretstringYour security code (starts with evy_sk_).
scopestringOptional. Permissions wanted, separated by spaces: a subset of the ones of your client. Omitted: all of them.

Response#

The token. It is never cached.

Example response#

json
{
  "access_token": "evy_at_0000000000000000000000000000000000000000000000000000000000000000",
  "token_type": "Bearer",
  "expires_in": 900,
  "scope": "products:read invoices:read"
}

Errors#

The error format and the full list of codes are described in Errors.

StatusWhen
400invalid_request, unsupported_grant_type or invalid_scope.
401invalid_client: missing or wrong credentials. The message is the same whatever the cause.
429rate_limited or too_many_attempts. See the Retry-After header.
503api_not_enabled for your company, or the service is temporarily unavailable.