Payabli Docs

Applies to:Developers

Payabli supports two ways to authenticate API requests. Payabli recommends OAuth2 Bearer tokens for all new integrations, because they’re short-lived, permission-scoped, and backed by credentials you can rotate. Some endpoints accept only OAuth2, and each endpoint’s API reference shows the authentication methods it accepts. The requestToken API token still works everywhere else, so existing integrations don’t need to migrate.

	API token	OAuth2 Bearer token
Sent as	`requestToken` header	`Authorization: Bearer` header
Lifetime	Long-lived (1–24 months)	Short-lived (hours; see `expires_in`)
How you get it	Create it in the Payabli Portal	Exchange a client ID and secret at the token endpoint
Use it when	You want a long-lived credential with minimal setup, or you’re maintaining an existing `requestToken` integration.	You want short-lived, rotatable, permission-scoped credentials.

API token — sent in the requestToken header. See API token authentication for the header, how to create tokens, and the token types.
OAuth2 Bearer token — obtained through the client-credentials flow. See OAuth authentication for the flow, and Manage API credentials for provisioning the client ID and secret.