Generate and revoke OAuth 2.0 Bearer tokens.
Payment Links APIs use OAuth 2.0 client credentials. Every API call requires a Bearer token in the Authorization header.
Getting your credentialsGo to PayU Dashboard → Developers → Client ID & Client secret details to find your
client_idandclient_secret. See Get Client ID and Secret for a walkthrough.
Different Base URLAuthentication endpoints use
accounts.payu.in, notoneapi.payu.in.
Environment Auth base URL Test https://uat-accounts.payu.inProduction https://accounts.payu.in
Scopes
A single token can carry up to three scopes simultaneously. You should pass them space-separated in the scope parameter.
| Scope | Grants access to |
|---|---|
create_payment_links | Create a Payment Link |
update_payment_links | Update or Cancel a Payment Link |
read_payment_links |
|
Request All Scopes in One CallYou can individual scope or add all scopes in one call as shown below:
scope=create_payment_links update_payment_links read_payment_links
Endpoints
These are the authentication APIs
How It Works
1. Generate a Token
Call Generate an Access Token API with your client_id, client_secret, grant_type: client_credentials, and the scopes your integration needs.
2. Cache the Token
Store access_token and calculate its expiry as created_at + expires_in.
3. Use the Token
Pass the token in the Authorization header of every Payment Links API call as shown below:
Authorization: Bearer {access_token}4. Refresh Before Expiry
Regenerate the token before it expires. The previous token stays valid until its exact expiry time, so there is no gap in service during rotation.
5. Revoke if Needed
Call the Revoke a Token API to invalidate a token early if needed. For example, when rotating credentials or if a token may have been exposed.
