> ## Documentation Index
> Fetch the complete documentation index at: https://docs.payven.com.tr/llms.txt
> Use this file to discover all available pages before exploring further.

# Access token al

> OAuth 2.0 Client Credentials akışıyla yeni access token üretir.

**Token cache'leyin** — her API çağrısında yeniden almayın. Identity'de rate limit vardır (token endpoint'i IP başına dakikada 10). Token expire olmadan [refresh](#issue-refresh-token) ile yenileyin.

Detay: [Kimlik Doğrulama](/documentation/concepts/authentication).



## OpenAPI

````yaml /api-reference/identity/openapi.json post /api/v1/auth/{slug}/token
openapi: 3.0.4
info:
  title: Payven Identity API
  description: >-
    Payven Identity — OAuth 2.0 kimlik doğrulama, API anahtarı yönetimi ve
    banka/BIN/MCC referans servisleri.
  termsOfService: https://payven.com.tr/sozlesmeler
  contact:
    name: Payven Developer Support
    url: https://docs.payven.com.tr
    email: destek@payven.com.tr
  license:
    name: Payven API License
    url: https://payven.com.tr/sozlesmeler/api-lisansi
  version: '1.0'
servers:
  - url: https://identity-sandbox.payven.com.tr
    description: Sandbox
  - url: https://identity.payven.com.tr
    description: Production
security:
  - bearerAuth: []
tags:
  - name: Auth
    x-displayName: Kimlik Doğrulama
  - name: Lookups
    x-displayName: Lookup Servisleri
  - name: Me
    x-displayName: Oturum
  - name: Merchants
    x-displayName: Bayiler
  - name: Permissions
    x-displayName: İzinler
  - name: PlatformFeatures
    x-displayName: Platform Özellikleri
  - name: PlatformPlans
    x-displayName: Platform Planları
  - name: PlatformTenantApiKeys
    x-displayName: Platform Tenant API Anahtarları
  - name: PlatformTenants
    x-displayName: Platform Tenant'lar
  - name: TenantApiKeys
    x-displayName: API Anahtarları
  - name: TenantRoles
    x-displayName: Roller
  - name: Users
    x-displayName: Kullanıcılar
  - name: Validation
    x-displayName: Validasyon
paths:
  /api/v1/auth/{slug}/token:
    post:
      tags:
        - Auth
      summary: Access token al
      description: >-
        OAuth 2.0 Client Credentials akışıyla yeni access token üretir.


        **Token cache'leyin** — her API çağrısında yeniden almayın. Identity'de
        rate limit vardır (token endpoint'i IP başına dakikada 10). Token expire
        olmadan [refresh](#issue-refresh-token) ile yenileyin.


        Detay: [Kimlik Doğrulama](/documentation/concepts/authentication).
      operationId: issueToken
      parameters:
        - name: slug
          in: path
          required: true
          schema:
            type: string
        - name: Idempotency-Key
          in: header
          schema:
            type: string
      requestBody:
        content:
          application/json; ver=1.0:
            schema:
              $ref: '#/components/schemas/ClientCredentialsRequest'
          text/json; ver=1.0:
            schema:
              $ref: '#/components/schemas/ClientCredentialsRequest'
          application/*+json; ver=1.0:
            schema:
              $ref: '#/components/schemas/ClientCredentialsRequest'
      responses:
        '200':
          description: OK
          content:
            text/plain; ver=1.0:
              schema:
                $ref: '#/components/schemas/KeycloakTokenResult'
            application/json; ver=1.0:
              schema:
                $ref: '#/components/schemas/KeycloakTokenResult'
            text/json; ver=1.0:
              schema:
                $ref: '#/components/schemas/KeycloakTokenResult'
        '400':
          description: Bad Request
          content:
            text/plain; ver=1.0:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
            application/json; ver=1.0:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
            text/json; ver=1.0:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        '401':
          description: Unauthorized
          content:
            text/plain; ver=1.0:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
            application/json; ver=1.0:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
            text/json; ver=1.0:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          description: Not Found
          content:
            text/plain; ver=1.0:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
            application/json; ver=1.0:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
            text/json; ver=1.0:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        '409':
          $ref: '#/components/responses/Conflict'
        '422':
          $ref: '#/components/responses/UnprocessableEntity'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
      security: []
      x-codeSamples:
        - lang: curl
          label: cURL
          source: >-
            curl -X POST
            https://identity-sandbox.payven.com.tr/api/v1/auth/8e3f5c12-9a7b-4c8d-bc4e-2c963f66afa6/token
            \
              -H "Authorization: Bearer $PAYVEN_TOKEN" \
              -H "Idempotency-Key: order-1001" \
              -d '{ ...payload... }'
        - lang: javascript
          label: Node.js
          source: |-
            const res = await fetch(
              "https://identity-sandbox.payven.com.tr/api/v1/auth/8e3f5c12-9a7b-4c8d-bc4e-2c963f66afa6/token",
              {
                method: "POST",
                headers: {
                  Authorization: `Bearer ${accessToken}`,
                  "Idempotency-Key": "order-1001",
                  "Content-Type": "application/json",
                },
                body: JSON.stringify({ /* payload */ }),
              },
            );
            const data = await res.json();
        - lang: python
          label: Python
          source: |-
            import httpx
            res = httpx.post(
                "https://identity-sandbox.payven.com.tr/api/v1/auth/8e3f5c12-9a7b-4c8d-bc4e-2c963f66afa6/token",
                headers={
                    "Authorization": f"Bearer {access_token}",
                    "Idempotency-Key": "order-1001",
                },
                json={ ... },
            )
            data = res.json()
        - lang: csharp
          label: C#
          source: >-
            var req = new HttpRequestMessage(HttpMethod.Post,
            "https://identity-sandbox.payven.com.tr/api/v1/auth/8e3f5c12-9a7b-4c8d-bc4e-2c963f66afa6/token");

            req.Headers.Authorization = new AuthenticationHeaderValue("Bearer",
            accessToken);

            req.Headers.Add("Idempotency-Key", "order-1001");

            // Content = JsonContent.Create(payload);

            var resp = await http.SendAsync(req);
        - lang: go
          label: Go
          source: >-
            req, _ := http.NewRequest("POST",
            "https://identity-sandbox.payven.com.tr/api/v1/auth/8e3f5c12-9a7b-4c8d-bc4e-2c963f66afa6/token",
            nil)

            req.Header.Set("Authorization", "Bearer "+accessToken)

            req.Header.Set("Idempotency-Key", "order-1001")

            // req.Body = bytes.NewReader(payloadJSON)

            resp, _ := http.DefaultClient.Do(req)
        - lang: php
          label: PHP
          source: >-
            $ch =
            curl_init("https://identity-sandbox.payven.com.tr/api/v1/auth/8e3f5c12-9a7b-4c8d-bc4e-2c963f66afa6/token");

            curl_setopt_array($ch, [
              CURLOPT_CUSTOMREQUEST => "POST",
              CURLOPT_RETURNTRANSFER => true,
              CURLOPT_HTTPHEADER => [
                "Authorization: Bearer $accessToken",
                "Idempotency-Key: order-1001",
              ],
              CURLOPT_POSTFIELDS => json_encode(\$payload),
            ]);

            $data = json_decode(curl_exec($ch), true);
components:
  schemas:
    ClientCredentialsRequest:
      type: object
      properties:
        client_id:
          type: string
          nullable: true
        client_secret:
          type: string
          nullable: true
      additionalProperties: false
    KeycloakTokenResult:
      type: object
      properties:
        access_token:
          type: string
          nullable: true
        refresh_token:
          type: string
          nullable: true
        expires_in:
          type: integer
          format: int32
        refresh_expires_in:
          type: integer
          format: int32
        token_type:
          type: string
          nullable: true
        scope:
          type: string
          nullable: true
      additionalProperties: false
    ProblemDetails:
      type: object
      properties:
        type:
          type: string
          nullable: true
        title:
          type: string
          nullable: true
        status:
          type: integer
          format: int32
          nullable: true
        detail:
          type: string
          nullable: true
        instance:
          type: string
          nullable: true
      additionalProperties: {}
  responses:
    Forbidden:
      description: Yetki yok, lisans yok veya merchant pasif.
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/ProblemDetails'
          example:
            type: https://docs.payven.com.tr/errors/forbidden
            title: Yetki yok
            status: 403
            code: forbidden
            detail: Bu rol bu kaynağı göremez.
    Conflict:
      description: Idempotency çakışması veya geçersiz durum geçişi.
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/ProblemDetails'
          example:
            type: https://docs.payven.com.tr/errors/idempotency_key_in_use
            title: Idempotency-Key çakışması
            status: 409
            code: idempotency_key_in_use
            detail: >-
              Bu Idempotency-Key daha önce farklı bir istek gövdesi ile
              kullanıldı.
    UnprocessableEntity:
      description: >-
        Validasyon veya iş kuralı ihlali (`bank_declined`, `validation_failed`,
        `fraud_blocked` vb.).
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/ProblemDetails'
          example:
            type: https://docs.payven.com.tr/errors/bank_declined
            title: Banka işlemi reddetti
            status: 422
            code: bank_declined
            detail: 'Yetersiz bakiye (banka kodu: 51)'
            provider_error_code: '51'
    TooManyRequests:
      description: Rate limit aşıldı. `Retry-After` header'ına uyun.
      headers:
        Retry-After:
          description: Yeniden denemeden önce beklemeniz gereken saniye sayısı.
          schema:
            type: integer
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/ProblemDetails'
          example:
            type: https://docs.payven.com.tr/errors/rate_limit_exceeded
            title: İstek limiti aşıldı
            status: 429
            code: rate_limit_exceeded
    ServerError:
      description: >-
        Sunucu hatası. Exponential backoff ile tekrar deneyin (Idempotency-Key
        ile).
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/ProblemDetails'
          example:
            type: https://docs.payven.com.tr/errors/internal_server_error
            title: Sunucu hatası
            status: 500
            code: internal_server_error
    ServiceUnavailable:
      description: >-
        Hedef konnektör geçici olarak devre dışı (circuit breaker açık) veya
        bağımlılık servisi erişilemez.
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/ProblemDetails'
          example:
            type: https://docs.payven.com.tr/errors/connector_unavailable
            title: Konnektör erişilemez
            status: 503
            code: connector_unavailable
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: >-
        Identity servisinden alinan Keycloak JWT. Format: `Authorization: Bearer
        <token>`. Token alma: POST /api/v1/auth/{slug}/token

````