Authentication

The chmod API uses the OAuth 2.0 client credentials grant. Your backend exchanges a client id and secret for a short-lived bearer token, then sends that token on every call.

These credentials belong on your server only. Never ship them in a mobile app, a browser bundle or a public repository. Your app receives an sdk_token scoped to a single transaction instead — that is the whole point of the split.

Request a token

curl -X POST https://{your-account}.auth.us-east-1.amazoncognito.com/oauth2/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=client_credentials" \
  -d "client_id=$CHMOD_CLIENT_ID" \
  -d "client_secret=$CHMOD_CLIENT_SECRET" \
  -d "scope=account-integration-api/account-api-access"

const body = new URLSearchParams({
  grant_type:    "client_credentials",
  client_id:     process.env.CHMOD_CLIENT_ID!,
  client_secret: process.env.CHMOD_CLIENT_SECRET!,
  scope:         "account-integration-api/account-api-access",
});

const res = await fetch(`${COGNITO_URL}/oauth2/token`, {
  method:  "POST",
  headers: { "Content-Type": "application/x-www-form-urlencoded" },
  body,
});

const { access_token, expires_in } = await res.json();

import os, requests

res = requests.post(
    f"{COGNITO_URL}/oauth2/token",
    data={
        "grant_type":    "client_credentials",
        "client_id":     os.environ["CHMOD_CLIENT_ID"],
        "client_secret": os.environ["CHMOD_CLIENT_SECRET"],
        "scope":         "account-integration-api/account-api-access",
    },
)
access_token = res.json()["access_token"]

Parameters

string

required

Always client_credentials.

string

required

Your account’s OAuth client id.

string

required

Your account’s OAuth client secret.

string

required

Always account-integration-api/account-api-access.

Response

{
  "access_token": "eyJraWQiOiJ...",
  "expires_in": 3600,
  "token_type": "Bearer"
}

string

The bearer token to send on API calls.

integer

Lifetime in seconds.

string

Always Bearer.

Use the token

Every request to the chmod API carries the token in the Authorization header, with the Bearer scheme:

curl https://{your-api-host}/api/account/integration/kyc/transaction \
  -H "Authorization: Bearer $ACCESS_TOKEN"

The same header goes on every endpoint — creating customers, creating transactions and reading results. There is nothing else to sign and no per-request nonce. A token is valid for one hour. Reuse it across requests until it expires; when the API answers 401, request a new one and retry. Tokens are not single-use, and requesting a new one does not invalidate the previous one.

The token identifies your account, not a user. Requests made with it act on your account’s customers and transactions, so keep it on the server and never forward it to a device.

Getting Started

Customers

Transactions

Transaction configuration

Results

Authentication

Request a token

Parameters

Response

Use the token

​Request a token

​Parameters

​Response

​Use the token

Request a token

Parameters

Response

Use the token