OAuth 2.0

Client Credentials

Use this grant for confidential server-side applications acting as themselves, without an interactive user.

Request a token

HTTP Basic client authentication

curl -sS -X POST https://api.threatprevent.io/oauth/token \
+  -u 'CLIENT_ID:CLIENT_SECRET' \
+  -H 'Content-Type: application/x-www-form-urlencoded' \
+  --data-urlencode 'grant_type=client_credentials' \
+  --data-urlencode 'scope=risk:payment risk:supply-chain'

HTTP Basic is recommended. If the registered client uses request-body authentication, send client_id and client_secret as form values instead. Never use both methods in one request.

Keep the secret server-side. Client Credentials must not be used by browser JavaScript, mobile applications, distributed extensions or other public clients.

Use the token

API request

curl https://api.threatprevent.io/v1/payment-risk \
+  -H 'Authorization: Bearer ACCESS_TOKEN' \
+  -H 'Content-Type: application/json' \
+  -d '{"email":"accounts@example.com"}'