Use this endpoint to generate and cache the token. You do not have to generate a new token before every API call.
Token validity is returned as expires_in seconds (typically 7200 — 2 hours). You should Calculate expiry as created_at + expires_in and regenerate before that moment.
POST
/oauth/token
Environments
| Environment | Base URL |
|---|---|
| Test | https://uat-accounts.payu.in |
| Production | https://accounts.payu.in |
Get Your Client ID and SecretGo to your PayU Dashboard → Developers → Client ID & Client secret details. See Get Client ID and Secret for a step-by-step walkthrough.
Sample Request
curl --location 'https://uat-accounts.payu.in/oauth/token' \
--header 'Content-Type: application/x-www-form-urlencoded' \
-d 'client_id={{client_id}}' \
-d 'client_secret={{client_secret}}' \
-d 'grant_type=client_credentials' \
-d 'scope=create_payment_links update_payment_links read_payment_links'import requests
url = "https://uat-accounts.payu.in/oauth/token"
payload = {
"client_id": "{{client_id}}",
"client_secret": "{{client_secret}}",
"grant_type": "client_credentials",
"scope": "create_payment_links update_payment_links read_payment_links"
}
response = requests.post(url, data=payload)
token_data = response.json()
access_token = token_data["access_token"]
print(access_token)const axios = require('axios');
const qs = require('querystring');
const response = await axios.post(
'https://uat-accounts.payu.in/oauth/token',
qs.stringify({
client_id: '{{client_id}}',
client_secret: '{{client_secret}}',
grant_type: 'client_credentials',
scope: 'create_payment_links update_payment_links read_payment_links'
}),
{ headers: { 'Content-Type': 'application/x-www-form-urlencoded' } }
);
const { access_token, expires_in } = response.data;
console.log(access_token);<?php
$ch = curl_init('https://uat-accounts.payu.in/oauth/token');
curl_setopt_array($ch, [
CURLOPT_RETURNTRANSFER => true,
CURLOPT_POST => true,
CURLOPT_POSTFIELDS => http_build_query([
'client_id' => '{{client_id}}',
'client_secret' => '{{client_secret}}',
'grant_type' => 'client_credentials',
'scope' => 'create_payment_links update_payment_links read_payment_links'
]),
CURLOPT_HTTPHEADER => ['Content-Type: application/x-www-form-urlencoded']
]);
$response = json_decode(curl_exec($ch), true);
curl_close($ch);
echo $response['access_token'];using var client = new HttpClient();
var request = new HttpRequestMessage(
HttpMethod.Post,
"https://uat-accounts.payu.in/oauth/token"
);
request.Content = new FormUrlEncodedContent(new[]
{
new KeyValuePair<string, string>("client_id", "{{client_id}}"),
new KeyValuePair<string, string>("client_secret", "{{client_secret}}"),
new KeyValuePair<string, string>("grant_type", "client_credentials"),
new KeyValuePair<string, string>("scope", "create_payment_links update_payment_links read_payment_links")
});
var response = await client.SendAsync(request);
var responseBody = await response.Content.ReadAsStringAsync();import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
HttpClient client = HttpClient.newHttpClient();
String formData =
"client_id={{client_id}}" +
"&client_secret={{client_secret}}" +
"&grant_type=client_credentials" +
"&scope=create_payment_links update_payment_links read_payment_links";
HttpRequest request = HttpRequest.newBuilder()
.uri(URI.create("https://uat-accounts.payu.in/oauth/token"))
.header("Content-Type", "application/x-www-form-urlencoded")
.POST(HttpRequest.BodyPublishers.ofString(formData))
.build();
HttpResponse<String> response = client.send(
request,
HttpResponse.BodyHandlers.ofString()
);
System.out.println(response.body());Refer to the Form Data section for a full description of all request parameters and use cases.
Sample Response
{
"access_token": "827c9f81aa7b9de0f0b33238733fa34a9f914fd41407fcac8fc73258aac1830e",
"token_type": "Bearer",
"expires_in": 7199,
"scope": "create_payment_links update_payment_links read_payment_links",
"created_at": 1790341162
}{
"error": "invalid_client",
"error_description": "Client authentication failed due to unknown client, no client authentication included, or unsupported authentication method."
}Refer to the Responses section for a full description of all response fields.
