Skip to main content
Client Credentials Grant Authorization (POS Authorization)

​
OAuth 2.0 – Client Credentials Grant (with Basic Auth)

This authorization flow is intended for Point-of-Sale (POS) systems that need to securely authenticate with our platform using OAuth 2.0 Client Credentials Grant. In this flow, the POS system (i.e., the client) authenticates itself directly using a client ID and client secret, which are provided to you during the integration setup process.

​
📘 Credentials

To authorize your POS system, you will receive:
  • client_id: The unique identifier for your POS integration
  • client_secret: A secure secret key associated with the client ID
⚠️ Important:
Your client_secret is sensitive and must be kept confidential. Never expose it in client-side applications or public repositories.

​
🔄 Token Request

To obtain an access token, make a POST request to the token endpoint using HTTP Basic Authentication.

​
📤 Request

Endpoint: POST https://logintest.clearline.me/connect/token Headers: Content-Type: application/x-www-form-urlencoded Authorization: Basic {Base64(client_id:client_secret)}
  • Replace {Base64(client_id:client_secret)} with the base64-encoded value of your credentials.
    • For example, if:
      • client_id = pos-demo
      • client_secret = s3cr3t!
Then: Authorization: Basic cG9zLWRlbW86czNjcjN0IQ==
Body Parameters: grant_type=client_credentials scope=pos_integration

​
✅ Example Request (curl)

curl -X POST https://logintest.clearline.me/connect/token \   -H "Content-Type: application/x-www-form-urlencoded" \   -H "Authorization: Basic cG9zLWRlbW86czNjcjN0IQ==" \   -d "grant_type=client_credentials&scope=pos_integration"

​
🎯 Successful Response

If your credentials are valid, the response will contain an access token: {   "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",   "token_type": "Bearer",   "expires_in": 3600,   "scope": "pos_integration" }
  • access_token: This token must be included in subsequent API requests
  • token_type: Always Bearer
  • expires_in: Lifetime of the token in seconds (typically 3600)

​
🔐 Using the Access Token

Include the access token in the Authorization header when making authenticated requests to POS-protected APIs. Example: Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...