post
https://sandbox-api.softpoint.io/interface/v1/locations/YOUR_LOCATION_ID/access_token
Exchanges your API key for a short lived, location scoped access token. This token authenticates every other Interface API call (users, locations, terminals, processors, menus, ordering, and card payments.
Request Headers
| Header | Required | Description |
|---|---|---|
Api-Key | Yes | The API key issued to your integration. Identifies the developer and authorizes token issuance. |
Request Parameters
Path Parameters
| Parameter | Type | Required | Description |
|---|---|---|---|
location_id | integer | Yes | The location the token will be scoped to. |
This endpoint takes no request body.
Request Example
No body is sent. The API key travels in the request header.
cURL Example
curl --request POST \
--url https://sandbox-api.softpoint.io/interface/v1/locations/location_id/access_token \
--header "Api-Key: YOUR_API_KEY"Success Response
{
"access_token": "access_token_value"
}Response Fields
| Field | Type | Description |
|---|---|---|
access_token | string | The bearer token to use on subsequent Interface API requests. |
Error Responses
Developer Not Found
Returned when the API key is not recognized.
{
"error": {
"code": 10879,
"message": "Developer not found",
"details": null
}
}Status Codes
| Code | Description |
|---|---|
200 | Token issued successfully. |
404 | API key not recognized (Developer not found). |
Workflow Placement
This is the first call in any Interface API integration:
- Generate Interface Token
- Create or configure resources (locations, users, terminals, processors).
- Operate (ordering, payments, reporting).
Notes
- The token is scoped to the
location_idin the path. Use a distinct token for each location. - Store the token securely and reuse it until it expires rather than requesting a new token for every API call.
- Expired or malformed tokens on downstream requests return error code
10759.
Common Mistakes
- Sending the API key as a Bearer token instead of in the
Api-Keyheader. - Requesting a token for one location and using it against a different location.
- Hardcoding an access token. Tokens are short-lived and must be refreshed.