Pinch Payments · Authentication Profile

Pinch Payments Authentication

Authentication

Pinch Payments secures its APIs with oauth2 and http across 2 declared security schemes, as derived from its OpenAPI definitions. OAuth 2.0 is offered via the clientCredentials flow(s).

PaymentsAustraliaPayment GatewayPayment ProcessingDirect DebitCard PaymentsSubscriptionBillingPayment FacilitatorAccount-to-AccountNew Zealand

Methods: oauth2, http Schemes: 2 OAuth flows: clientCredentials API key in:

Security Schemes

OAuth2 client-credentials oauth2

· flows:

HTTP Basic (token endpoint only) http

scheme: basic

Source

Authentication Profile

generated: '2026-07-24'
method: searched
source: openapi/pinch-payments-authentication.yml + https://docs.getpinch.com.au/docs/application-authentication
docs: https://docs.getpinch.com.au/docs/application-authentication
summary:
  types:
  - oauth2
  - http
  model: OAuth 2.0 client-credentials
  detail: >-
    Every Pinch API request requires a Bearer JWT. Obtain one by POSTing to the
    token endpoint (auth.getpinch.com.au/connect/token) with grant_type=client_credentials
    and scope=api1, authenticating with your Application ID + Secret Key via HTTP
    Basic (base64(client_id:client_secret)) or as client_id/client_secret in the
    x-www-form-urlencoded body. The response is a Bearer token that expires in 3600s;
    cache and reuse it. Send it as `Authorization: Bearer <token>` on every request.
    Authenticating with a Merchant ID as client_id is DEPRECATED — new integrations
    must use an Application. Client-side card/bank tokenisation (CaptureJS) uses a
    separate Merchant Publishable key (pk_test_.../pk_live_...).
  oauth2_flows: [clientCredentials]
  token_url: https://auth.getpinch.com.au/connect/token
  token_ttl_seconds: 3600
  scopes: [api1]
schemes:
- name: OAuth2 client-credentials
  type: oauth2
  flows:
    clientCredentials:
      tokenUrl: https://auth.getpinch.com.au/connect/token
      scopes:
        api1: Full access to the Pinch REST API
  sources:
  - openapi/pinch-payments-contacts.yml
  - openapi/pinch-payments-core.yml
  - openapi/pinch-payments-merchant-financial-data.yml
  - openapi/pinch-payments-merchants.yml
  - openapi/pinch-payments-payers.yml
  - openapi/pinch-payments-payment-links.yml
  - openapi/pinch-payments-payments.yml
  - openapi/pinch-payments-transfers.yml
  - openapi/pinch-payments-webhooks.yml
- name: HTTP Basic (token endpoint only)
  type: http
  scheme: basic
  note: >-
    Used only at the /connect/token endpoint to present the Application ID + Secret
    Key when exchanging for a Bearer token; not used against the resource API.
  sources:
  - openapi/pinch-payments-authentication.yml

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this

find_securityBrowse and filter every security artifact in the catalog.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This security artifact

curl "https://apis.io/api/v1/security/pinch-payments-authentication"

All security posture

curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no email required.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.