curl https://loyalty.thanxsandbox.com/loyalty-api/oauth/token \
-X POST \
-H "Content-Type: application/json" \
-d '{
"grant_type": "client_credentials",
"client_id": "${client_id}",
"client_secret": "${client_secret}"
}'
{
"access_token": "945148251b603ae34561d90acfe4050e67494d6d1e65d4d3d52798407f03c0bd",
"token_type": "Bearer",
"expires_in": 1800,
"scope": "passwordless v3"
}
{
"error": "invalid_client",
"error_description": "Invalid Client ID / Secret",
"error_uri": null
}
{
"error": "unsupported_grant_type",
"error_description": "Only client_credentials grant_type is supported",
"error_uri": null
}
{
"code": 404,
"message": "The requested service is unavailable"
}
Reference
Create Guest Token
This endpoint mints a short-lived guest access token from your Merchant-owned OAuth app credentials, for applying a Universal Promo Code to a basket without an end-user.
POST
/
loyalty-api
/
oauth
/
token
curl https://loyalty.thanxsandbox.com/loyalty-api/oauth/token \
-X POST \
-H "Content-Type: application/json" \
-d '{
"grant_type": "client_credentials",
"client_id": "${client_id}",
"client_secret": "${client_secret}"
}'
{
"access_token": "945148251b603ae34561d90acfe4050e67494d6d1e65d4d3d52798407f03c0bd",
"token_type": "Bearer",
"expires_in": 1800,
"scope": "passwordless v3"
}
{
"error": "invalid_client",
"error_description": "Invalid Client ID / Secret",
"error_uri": null
}
{
"error": "unsupported_grant_type",
"error_description": "Only client_credentials grant_type is supported",
"error_uri": null
}
{
"code": 404,
"message": "The requested service is unavailable"
}
Guest Universal Promo Codes must be enabled for your account by Thanx. See
Guest Universal Promo Codes for the full flow.
client_id / client_secret in the JSON
request body, the same way you call Acquire Access Token.
No Merchant-Key header is needed for this call. This route is served under
/loyalty-api/, not /api/.
Reuse a token until it expires instead of minting one per basket.
Parameters
string
required
Must be
client_credentials.string
required
Your Merchant-owned OAuth app’s Client ID
string
required
Your Merchant-owned OAuth app’s Client Secret
HTTP Basic
client_id:client_secret is also accepted; when an
Authorization: Basic header is sent, it is used instead of the body. Never
send the credentials in the URL query string — that returns invalid_client.Response
string
The guest Bearer token, for use on Create & Update Basket.
string
The type of token,
Bearerinteger
Token lifetime in seconds. Currently
1800 (30 minutes). There is no refresh
token — re-mint a new guest token once the current one expires.string
The OAuth scopes configured on your app. This echoes your app’s own
configuration and varies per integration.
Errors
| Condition | Status | Response |
|---|---|---|
Unknown client_id, wrong client_secret, credentials sent in the query string, or an app that is not Merchant-owned | 401 | invalid_client |
grant_type is not client_credentials | 401 | unsupported_grant_type |
| Guest Universal Promo Codes not enabled for the app’s merchant | 404 | {"code": 404, "message": "The requested service is unavailable"} |
curl https://loyalty.thanxsandbox.com/loyalty-api/oauth/token \
-X POST \
-H "Content-Type: application/json" \
-d '{
"grant_type": "client_credentials",
"client_id": "${client_id}",
"client_secret": "${client_secret}"
}'
{
"access_token": "945148251b603ae34561d90acfe4050e67494d6d1e65d4d3d52798407f03c0bd",
"token_type": "Bearer",
"expires_in": 1800,
"scope": "passwordless v3"
}
{
"error": "invalid_client",
"error_description": "Invalid Client ID / Secret",
"error_uri": null
}
{
"error": "unsupported_grant_type",
"error_description": "Only client_credentials grant_type is supported",
"error_uri": null
}
{
"code": 404,
"message": "The requested service is unavailable"
}