> ## Documentation Index
> Fetch the complete documentation index at: https://developers.uvvipay.com.br/llms.txt
> Use this file to discover all available pages before exploring further.

# Emitir bearer token

> Emite um bearer token pelo fluxo OAuth2 client_credentials. Envie as credenciais no body (JSON ou application/x-www-form-urlencoded) ou no header Authorization: Basic base64(client_id:client_secret). O token expira em 3600 segundos. A resposta retorna os headers Cache-Control: no-store e Pragma: no-cache (RFC 6749).

<Note>
  O endpoint segue a RFC 6749 (OAuth2, grant `client_credentials`). Crie o
  `client_id` e o `client_secret` no painel, em **Configurações → API
  Clients**. O `client_secret` aparece uma única vez na criação.
</Note>

O token expira em 3600 segundos. Quando o token expirar, emita um novo com as
mesmas credenciais. Envie o token no header `Authorization`:

```bash theme={null}
curl https://api.uvvipay.com.br/recurso-protegido \
  -H "Authorization: Bearer SEU_ACCESS_TOKEN"
```

**NOTA:** se o client for desativado no painel, a API rejeita os tokens dele
na hora, antes de o token expirar.


## OpenAPI

````yaml POST /oauth/token
openapi: 3.0.0
info:
  title: UvviPay Public API
  description: >-
    Endpoints públicos da plataforma UvviPay para integração de subcontas
    (submerchants).
  version: 1.0.0
  contact: {}
servers:
  - url: https://api.uvvipay.com.br
    description: Produção
  - url: https://api-staging.uvvipay.com.br
    description: Staging
security:
  - client-id: []
    client-secret: []
tags: []
paths:
  /oauth/token:
    post:
      tags:
        - OAuth
      summary: Emitir bearer token
      description: >-
        Emite um bearer token pelo fluxo OAuth2 client_credentials. Envie as
        credenciais no body (JSON ou application/x-www-form-urlencoded) ou no
        header Authorization: Basic base64(client_id:client_secret). O token
        expira em 3600 segundos. A resposta retorna os headers Cache-Control:
        no-store e Pragma: no-cache (RFC 6749).
      operationId: oauthToken
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/OauthTokenRequest'
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/OauthTokenRequest'
      responses:
        '200':
          description: Token emitido.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OauthTokenResponse'
        '400':
          description: grant_type diferente de client_credentials.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OauthErrorResponse'
              example:
                error: unsupported_grant_type
                error_description: Somente o grant_type "client_credentials" e suportado.
        '401':
          description: client_id ou client_secret invalido, ausente ou client desativado.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OauthErrorResponse'
              example:
                error: invalid_client
                error_description: Credenciais invalidas.
      security: []
components:
  schemas:
    OauthTokenRequest:
      type: object
      required:
        - grant_type
      properties:
        grant_type:
          type: string
          enum:
            - client_credentials
          description: Unico grant suportado.
          example: client_credentials
        client_id:
          type: string
          description: >-
            Identificador do client. Opcional se enviado via Authorization:
            Basic.
          example: client_6ed22e426acd12d8aeb3ebc6
        client_secret:
          type: string
          description: 'Secret do client. Opcional se enviado via Authorization: Basic.'
          example: secret_...
    OauthTokenResponse:
      type: object
      required:
        - access_token
        - token_type
        - expires_in
      properties:
        access_token:
          type: string
          description: 'Bearer token opaco. Envie no header Authorization: Bearer <token>.'
        token_type:
          type: string
          enum:
            - Bearer
          example: Bearer
        expires_in:
          type: number
          description: Validade do token em segundos.
          example: 3600
    OauthErrorResponse:
      type: object
      required:
        - error
      properties:
        error:
          type: string
          enum:
            - invalid_client
            - unsupported_grant_type
        error_description:
          type: string
  securitySchemes:
    client-id:
      type: apiKey
      in: header
      name: client-id
    client-secret:
      type: apiKey
      in: header
      name: client-secret

````