Authentication

Every request to the Partner Payments API must include an Authorization header. You can send your API key with each request or exchange it for an access token.

Use an API key

Send your API key on every request:

Authorization: ApiKey pc_<your-key>

The API also accepts the key without the ApiKey prefix:

Authorization: pc_<your-key>

API keys do not expire. Store your key securely and send it only from your backend.

Use an access token

Call POST /api/partner/v1/auth/token with your API key in the Authorization header. The response includes an access token, a JWT that authenticates subsequent requests:

Authorization: Bearer <jwt>

Use an access token when you want to make requests without sending your API key each time. A card token represents card details and cannot authenticate requests.

Token lifetime and renewal

Access tokens are valid for one hour, as indicated by expiresIn: 3600. When a token expires, exchange your API key for a new access token. There is no refresh token.

Rotation and account deactivation

When GroGov rotates an API key, requests using the previous key fail immediately. Access tokens already issued from that key remain valid until they expire. Deactivating your API account blocks requests using either credential on the next request. Contact GroGov support to rotate or revoke your API key or deactivate your account.

Authentication failures

The following conditions return 401 Unauthorized:

A missing or malformed API key, including a key without the pc_ prefix.
An unknown or revoked API key.
An inactive API account.
A malformed or expired access token.

Authentication examples

The following examples show the same GET /api/partner/v1/payments call using each authentication method:

curl "https://apistagepc.grogov.us/api/partner/v1/payments" \
  -H "Authorization: ApiKey pc_<your-sandbox-key>"

curl "https://apistagepc.grogov.us/api/partner/v1/payments" \
  -H "Authorization: Bearer $JWT"

const res = await fetch(
  "https://apistagepc.grogov.us/api/partner/v1/payments",
  { headers: { Authorization: "ApiKey pc_<your-sandbox-key>" } },
);
const { data } = await res.json();

const res = await fetch(
  "https://apistagepc.grogov.us/api/partner/v1/payments",
  { headers: { Authorization: `Bearer ${jwt}` } },
);
const { data } = await res.json();

See Errors for the full error envelope returned on authentication failures and other error conditions.

Get started

Core concepts

Hosted checkout

Testing

Use an API key

Use an access token

Token lifetime and renewal

Rotation and account deactivation

Authentication failures

Authentication examples

​Use an API key

​Use an access token

​Token lifetime and renewal

​Rotation and account deactivation

​Authentication failures

​Authentication examples

Use an API key

Use an access token

Token lifetime and renewal

Rotation and account deactivation

Authentication failures

Authentication examples