---
updatedAt: 2026-03-06T12:03:45.000Z
agentTools:
  projectIndex: https://docs.yumbi.com/llms.txt
---

# Authentication

## Implementing OAuth 2.0

### Intro to OAuth

When people talk about OAuth, they typically mean OAuth 2.0: an authorization framework that describes how unrelated services can grant access to resources. It’s an open standard used by apps, APIs, and other services over HTTPS.

OAuth decouples authentication from authorization, by relying on a third party to grant an access token. Doing this reduces your attack surface since your client secret is not required to access certain resources. The Authorization Server authenticates a user and approves their access to a resource by providing a temporary authorization code. A token can then be requested using your credentials along with this authorization code.

OAuth2.0 specification is outlined in [RFC 6479](https://tools.ietf.org/html/rfc6749)

## OAuth Process Flow

### Process descriptions

1.1 Send your YUMBI Gateway-issued client ID and client secret in the [Request Access Token](https://auth.yumbi.com/oauth2/token) call to retrieve an access token.

1.2 Your client ID and client secret are verified.

1.3 The access token is returned in the response.

2.1 Use the access token to make requests to the YUMBI Gateway API.

## Steps to implement OAuth

First, you will need to call [Request Access Token](https://auth.yumbi.com/oauth2/token) to obtain a client access token by sending the client ID and client secret to the authorisation server to retrieve an access token (YUMBI Gateway provides you with the client ID and client secret when you are onboarded).

You can do this by sending a POST request:

```json
POST /oauth2/token HTTP/1.1
Host:   https://auth.yumbi.com
Content-Type: application/x-www-form-urlencoded
{
  "client_id": "CLIENT_ID",
  "client_secret": "CLIENT_SECRET",
  "grant_type": "client_credentials"
}
```

The client\_id and client\_secret properties should contain your client id and client secret respectively. They will be validated to check that you can get an access token. The grant\_type determines which authentication flow should be used. When initiating this call, always set the value of grant\_type as client\_credentials.

The access token will be returned in the response, and will look like this:

```json
HTTP/1.1 200 OK

{
    "access_token": "eyJraWQiOiJYRE...",
    "expires_in": 3600,
    "token_type": "Bearer"
}
```

All API calls to the YUMBI Gateway API must be performed using a valid access token as the header authorisation parameter, and would look like this:

```
curl https://gateway.yumbi.com/api/v1/webhooks -H "Authorization: Bearer {access_token}"
```