Understand the two authentication methods supported by PayNearMe's API v3.0—OAuth 2.0 Bearer tokens and HMAC-SHA256 signatures—and learn how to choose the right approach based on security requirements, implementation complexity, and access control needs.
New Client Authentication RequirementsAs of August 1, 2026, PayNearMe requires all new clients using API v3.0 and later to authenticate via OAuth 2.0. Existing clients using HMAC signatures will continue to be supported.
PayNearMe supports two authentication methods for API version 3.0+ outbound calls: HMAC signature and OAuth 2.0 Bearer tokens. Outbound API calls must be authenticated using one of these methods. If your request includes an Authorization: Bearer {access_token} header, PayNearMe uses OAuth to authorize access; otherwise, you'll need to include a hash-based message authentication code (HMAC) signature. An HMAC signature is a string of characters that authenticate messages received from the API and server-side callbacks. This authentication method protects the integrity of request messages and helps to prevent malicious attacks like cross-site scripting and brute-force attacks.
OAuth access tokens are short-lived credentials your application obtains from PayNearMe’s token endpoint after proving it holds valid client credentials (Client ID and Client Secret). The token is an opaque or signed string you send on each API request in the Authorization header; you do not send the Client Secret on routine API calls. PayNearMe validates each token before your request reaches protected resources: it checks that the token is valid, unexpired, and issued for the correct audience and site. If validation fails, the API returns 401 Unauthorized and does not process the call.
Callbacks continue to use API keys and HMAC signatures. See the HMAC Signature Authentication and OAuth 2.0 Authentication pages for detailed instructions and code samples.