Skip to content
KivraDevelopers
This is a new version of the Kivra Developer Docs. Report issues or share feedback at avsandare.support@kivra.se. The previous version can be found here.

Authentication

Start with a partner-scoped OAuth 2.0 token. A partner token can send receipts for every business unit owned by your organisation. Kivra creates or links the corresponding retail records from the business_unit data in each receipt.

Terminal window
curl -X POST https://sender.sandbox-api.kivra.com/dr/v1/auth/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=client_credentials" \
  -d "client_id=$KIVRA_CLIENT_ID" \
  -d "client_secret=$KIVRA_CLIENT_SECRET"

The response includes an access token, token type, and expiry. Send the token with protected requests:

Authorization: Bearer <access_token>

Tokens are JWTs with a limited validity period, typically 24 hours. Refresh them before expiry and store credentials and tokens only in a server-side secrets system. Do not place them in a POS client, browser code, source control, or logs.

For integrations that must restrict an installation to one chain or store, see Advanced use cases.