Skip to main content
All APIs use Bearer authentication. Before you can call any IPXO API, you need to obtain an access token. This token is used to authenticate and authorize all subsequent API requests. IPXO APIs use OAuth 2.0 Client Credentials flow, which is designed for server-to-server integrations (no user interaction required).

When should I use this?

Use this authentication method when:
  • You are building a backend service or automation
  • You already have API credentials (client ID + secret)
  • You want to access billing, ecommerce, or credits APIs programmatically

Where do I get API credentials?

To obtain your Client ID and Client Secret:
  1. Log in to your IPXO account
  2. Open the Integrations page in the portal: 👉 https://www.ipxo.com/portal/integrations
  3. Click Create App
  4. Give your application a name and select the required scopes
  5. Save the app
After creation, you will be provided with:
  • Client ID
  • Client Secret
🔐 The Client Secret is shown only once. Make sure to store it securely.

Prerequisites

Before calling the authentication endpoint, you need:
  • Client ID – created via Portal → Integrations
  • Client Secret – created together with the client ID
  • Scopes – define which APIs your token can access
Example scopes used in the guides:
  • billing
  • ecommerce
  • credits
  • nethub-data
Scopes must be provided as a space-separated list.

Generate Access Token

Request: Get an access token

curl 'https://hydra.ipxo.com/oauth2/token' \
  -X POST \
  -d 'grant_type=client_credentials' \
  -d 'client_id={client_id}' \
  -d 'client_secret={client_secret}' \
  -d 'scope=billing ecommerce credits'

Response

{
  "access_token": "{access_token}",
  "expires_in": 86399,
  "scope": "billing ecommerce credits",
  "token_type": "bearer"
}

Key response fields explained

FieldMeaning
access_tokenBearer token used to authorize API requests
expires_inToken lifetime in seconds (≈ 24 hours)
scopeAPIs this token can access
token_typeAlways bearer

Using the access token

Send the token in the Authorization header for all API calls: Authorization: Bearer {access_token} Example:
curl 'https://apigw.ipxo.com/ecommerce/public/{tenant_uuid}/cart' \
-H 'Authorization: Bearer {access_token}'