Skip to main content
Authentication happens in two steps:
1

Login

Exchange clientId + apiKey for an access token (JWT) at POST /api/v1/auth.
2

Access

Send the token in the Authorization: Bearer <token> header on every request.

​
Getting the token

Response 200 OK:

​
Using the token

​
Token lifecycle

The token expires after a period. When that happens, your requests will return 401 — just call /api/v1/auth again to get a new one.Don’t generate a new token on every request (you’ll hit the rate limit). Reuse the same token until it expires.

​
Security best practices

Treat the apiKey like a password

Never expose your apiKey in frontend code, public repositories, or logs.

Always HTTPS

All calls must use HTTPS. Plain HTTP requests fail.

Reuse the token

Keep the token in memory and reuse it across calls until you get a 401.

Rotate credentials

If you suspect a leak, request an apiKey regeneration from the PagAmerican team.

​
Personal data (privacy)

The /api/v1/purchases response includes your customers’ personal data (name, email, phone, address). Use it only for authorized purposes and store it securely.