Authentication

Authentication

All requests to the CrissCross APIs (Collect, Exchange, and Payouts) require an access token. CrissCross uses OAuth 2.0 style access tokens for authenticating API requests. Authentication is machine-to-machine: request a token with your client_id and client_secret, then include it as a Bearer token in the Authorization header on every subsequent request.

Request an access token

POST https://api.crisscross.money/v1/auth/oauth2/token

$
curl --request POST 'https://api.crisscross.money/v1/auth/oauth2/token' \
>
  --header 'Content-Type: application/json' \
>
  --data-raw '{
>
    "client_id": "YOUR_CLIENT_ID",
>
    "client_secret": "YOUR_CLIENT_SECRET"
>
  }'

Response

1
{
2
  "access_token": "eyJhbGci...",
3
  "token_type": "Bearer",
4
  "expires_in": 86400
5
}

Store the token until it expires. expires_in is the token’s lifetime in seconds (currently 86400, or 24 hours). There is no refresh token; request a new token when the current one expires.

Use the token

$
curl --request GET 'https://api.crisscross.money/v1/<your-endpoint>' \
>
  --header 'Authorization: Bearer YOUR_ACCESS_TOKEN'

Handling authentication failures

• 400 Bad Request: client_id or client_secret is missing from the request body.
• 401 Unauthorized: the credentials are invalid, or the access token is missing or expired.

Best practices

• Secure storage: keep your client_secret and access tokens in a secrets manager or environment variables, never in source code.
• Rotate on compromise: if your client_secret is exposed, rotate it immediately.