Levelup Authentication

generated: '2026-07-19'
method: searched
source: >-
  https://github.com/TheLevelUp/levelup-sdk-ruby (lib/levelup/requests/base.rb,
  lib/levelup/endpoints/access_tokens.rb, README), https://github.com/TheLevelUp/levelup-sdk-csharp (README)
docs: null
docs_note: >-
  The canonical auth documentation lived at http://developer.thelevelup.com/api-reference/ ,
  which no longer resolves. The profile below is reconstructed verbatim from the first-party
  open-source SDKs, which are the surviving authoritative description of the auth model.
status: retired
summary:
  types: [apiKey, custom-token]
  api_key_in: [body]
  token_in: [header]
  token_header: Authorization
  token_scheme: token
  oauth2_flows: []
  note: >-
    LevelUp used a bearer-like access-token model with a custom "token" Authorization scheme
    rather than OAuth 2.0. Credentials (app API key + client secret, or merchant username +
    password) were exchanged at the access_tokens endpoint for an access token, which was then
    sent on the Authorization header. There is no OAuth 2.0 scope surface, so no scopes/ artifact.
schemes:
- name: appAccessToken
  type: custom-token
  in: header
  header: Authorization
  format: 'token <app_access_token>'
  obtained_by: >-
    POST access_tokens with api_key (app API key) + client_secret; returns an app access token.
  audience: application / point-of-sale integration
- name: merchantAccessToken
  type: custom-token
  in: header
  header: Authorization
  format: 'token merchant="<merchant_access_token>"'
  v14_format: 'token <merchant_access_token>'
  obtained_by: >-
    POST access_tokens with the merchant account username + password (plus the app API key).
  audience: merchant account
- name: userAccessToken
  type: custom-token
  in: header
  header: Authorization
  format: 'token user="<user_access_token>"'
  audience: end user / consumer account
- name: merchantAndUserAccessToken
  type: custom-token
  in: header
  header: Authorization
  format: 'token merchant="<merchant_access_token>", user="<user_access_token>"'
  audience: combined merchant + user context
auth_types_in_sdk:
  enumerated: [none, merchant, app, merchant_and_user, user, merchant_v14]
  source: levelup-sdk-ruby lib/levelup/requests/base.rb auth_header_value
transport_requirements:
- requirement: TLS 1.2 required
  scope: [www.thelevelup.com, api.thelevelup.com]
  reason: PCI security standards compliance
  source: https://github.com/TheLevelUp/levelup-sdk-csharp
  tooling: https://github.com/TheLevelUp/pos-tls-patcher
environments:
- {name: sandbox, base_url: 'https://sandbox.thelevelup.com/', real_money: false, dns: NXDOMAIN}
- {name: production, base_url: 'https://api.thelevelup.com/', real_money: true, dns: NXDOMAIN}
- {name: staging, base_url: null, note: 'referenced as a built-in LevelUpEnvironment in the C# SDK'}
signup: 'https://www.thelevelup.com/users/new (now redirects to grubhub.com)'