{"templateId":"markdown","sharedDataIds":{"sidebar":"sidebar-docs/sidebars.yaml","oas-specs/authentication/client-credentials.yaml":"oas-specs/authentication/client-credentials.yaml"},"props":{"metadata":{"markdoc":{"tagList":["admonition","openapi-code-sample"]},"type":"markdown"},"seo":{"title":"Client credentials authentication","llmstxt":{"hide":false,"sections":[{"title":"Table of contents","includeFiles":["**/*"],"excludeFiles":[]}],"excludeFiles":[]}},"dynamicMarkdocComponents":["openapi"],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"client-credentials-authentication","__idx":0},"children":["Client credentials authentication"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Tyro Connect’s APIs require authentication, and Tyro Connect’s authorisation server uses the ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://oauth.net/2/grant-types/client-credentials/"},"children":["OAuth 2.0 Client Credentials Flow"]}," to authenticate partner systems. App integrations always use this flow. POS integrations use it for ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/docs/getting-started/authentication"},"children":["POS Cloud Connections"]}," — POS Instance Connections use the ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/docs/getting-started/authentication/device-code"},"children":["device code flow"]}," instead."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["To get started, you must first request a set of credentials from Tyro Connect. Once provided, these credentials contain two values: a ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["client_id"]}," and ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["client_secret"]},"."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Each request to a Tyro Connect API is authenticated with a JWT (JSON Web Token). To obtain a JWT, make a request to the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["/oauth/token"]}," endpoint of the authorisation server, setting ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["audience"]}," to ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["https://app.connect.tyro"]}," for an App integration, or ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["https://pos.connect.tyro"]}," for a POS Cloud Connection."]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info","name":"Best practice tips"},"children":[{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["The credentials we provide you with are private and should be stored securely."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Each JWT expires after 12 hours. Partners are encouraged to monitor the expiry of their token and refresh expired tokens prior to making calls to any of the APIs."]}]}]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"warning","name":"Authorisation server rate limits"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["If a partner requests more than 12 tokens within an 11-hour period the authorisation server will reject the requests."," ","Please make sure you cache your tokens and only request a token when it is about to expire."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["You can try it out and generate a code snippet below — pick the example that matches your audience, and make sure to save the result as the returned ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["access_token"]}," can be used for making any other REST API requests."]},{"$$mdtype":"Tag","name":"OpenApiCodeSample","attributes":{"descriptionFile":"oas-specs/authentication/client-credentials.yaml","operationId":"generate-token","parameters":{},"environments":{}},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["A successful response contains:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["access_token"]},": This is the JSON Web Token (JWT) that you will use to make authenticated requests to Tyro Connect. You must pass the retrieved Access Token as a Bearer token in the Authorization header of your Tyro Connect REST API request."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["expires_in"]},": This is the number of seconds until the Access Token expires. Please use this value to determine when to request a new ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["access_token"]}," and to respect the rate limits of the authorisation server."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["token_type"]},": This value is always ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Bearer"]},"."]}]}]},"headings":[{"value":"Client credentials authentication","id":"client-credentials-authentication","depth":1}],"frontmatter":{"seo":{"title":"Client credentials authentication"}},"lastModified":"2026-09-02T06:39:28.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/docs/getting-started/authentication/client-credentials","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}