Authentication

Corpay uses a token-based authentication flow. In most integrations, you first obtain a partner-level token, then use that to generate the client-level access token required for API calls.

Corpay Cross-Border API uses the OAuth2.0 standard authorization framework, with a two-step authentication flow. Authentication is performed by exchanging an HS256-signed JSON Web Token (JWT) for a CMG-AccessToken, which is included in the header of subsequent API requests.

Authentication Flow

The authentication process consists of two steps:

1. Partner Authentication – Exchange a signed JWT for a Partner access token.
2. Client Authentication – Use the Partner access token to request a Client access token for the client you want to access.

Create a JWT using the following claims:

The partner-level and the client-level work in the following way:

1. Set the iss claim to the applicable Partner or Client identifier and sign an encoded JWT token (hashed via HS256).
2. Send the encoded JWT in the assertion field of the authentication request.
3. A successful response returns an access_code. Include this value in the CMG-AccessToken header when making the subsequent (Client-Level) requests.

If authentication fails, check the following:

• Your credentials are valid for the correct environment.
• Your client and partner IDs match the account you are using.
• The token has not expired.
• The request includes the required headers.