Upgrade Authentication

generated: '2026-07-21'
method: searched
source: https://docs.uplift.com/apidocs/authorization-1
docs: https://docs.uplift.com/apidocs/authorization-1
description: >-
  Authentication profile for the Flex Pay APIs (Upgrade). Both the marketing and
  checkout REST APIs use OAuth 2.0 — an access token obtained with the
  client-credentials grant (client ID/secret sent as Basic credentials to the
  token endpoint) and included as a Bearer token in the Authorization header of
  every API request. Credentials are issued per merchant and per environment by
  the Flex Pay integration team, gated on a server IP allowlist review.
summary:
  types: [oauth2]
  oauth2_flows: [clientCredentials]
  token_usage: 'Authorization: Bearer {token}'
  token_expiry: 30 minutes (default) — refresh shortly before expiry
  ip_allowlist_required: true
schemes:
  - name: flexPayOAuth
    type: oauth2
    flows:
      - flow: clientCredentials
        tokenUrl: https://partner.upgrade.com/api/auth/v1/oauth/token?grant_type=client_credentials
        tokenUrl_preprod: https://partner.credify.tech/api/auth/v1/oauth/token?grant_type=client_credentials
        token_request_auth: 'Authorization: Basic {base64_encoded_credentials}'
        scopes: []
    sources: [openapi/upgrade-flexpay-openapi.yml]
endpoints:
  production: https://partner.upgrade.com/api/flexpay
  pre_production: https://partner.credify.tech/api/flexpay
credential_issuance: >-
  Client IDs and client secrets are generated on a per-merchant and
  per-environment basis during onboarding. A comprehensive list of server IP
  addresses must be provided for security review before pre-production and
  production credentials are issued.
best_practices:
  - Share secrets only over secure channels (never email or unencrypted HTTP).
  - Store secrets in a secrets manager, KMS, or encrypted database — never in code repositories or client-side code.