Authentication failures - Payments API

#!/usr/bin/env bash
# Exchange a secret key for a short-lived access token (300s) and a refresh
# token (3900s, single-use rotation). Never expose the secret key to a browser.
set -euo pipefail

API_BASE="${RADIUMONE_API_BASE:-https://api-sandbox.radiumone.io/gateway}"

curl -sS -X POST "$API_BASE/v1/auth/token" \
  -H "Content-Type: application/json" \
  -d @request.json

#!/usr/bin/env node
// Exchange a secret key for a short-lived access token. Node 18+ ESM fetch.
// Env: RADIUMONE_SECRET_KEY (server-side only), RADIUMONE_API_BASE (optional override).
import { readFileSync } from "node:fs";

const API_BASE = process.env.RADIUMONE_API_BASE || "https://api-sandbox.radiumone.io/gateway";
const body = JSON.parse(readFileSync(new URL("./request.json", import.meta.url)));
if (process.env.RADIUMONE_SECRET_KEY) body.api_key = process.env.RADIUMONE_SECRET_KEY;

async function createAccessToken() {
  const res = await fetch(`${API_BASE}/v1/auth/token`, {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify(body),
  });
  const payload = await res.json();
  if (!res.ok) {
    throw new Error(`auth/token failed: ${payload.type ?? payload.code} (${res.status})`);
  }
  // Cache access_token server-side for up to expires_in seconds; use
  // refresh_token to get a new pair before it lapses.
  return payload;
}

createAccessToken().then((r) => console.log(JSON.stringify(r, null, 2)));

#!/usr/bin/env python3
"""Exchange a secret key for a short-lived access token. Python 3.10+, requests."""
import json
import os
from pathlib import Path

import requests

API_BASE = os.environ.get("RADIUMONE_API_BASE", "https://api-sandbox.radiumone.io/gateway")


def create_access_token() -> dict:
    body = json.loads((Path(__file__).parent / "request.json").read_text())
    if os.environ.get("RADIUMONE_SECRET_KEY"):
        body["api_key"] = os.environ["RADIUMONE_SECRET_KEY"]

    resp = requests.post(f"{API_BASE}/v1/auth/token", json=body, timeout=30)
    payload = resp.json()
    if not resp.ok:
        raise RuntimeError(f"auth/token failed: {payload.get('type') or payload.get('code')} ({resp.status_code})")
    # Cache access_token server-side for up to expires_in seconds; use
    # refresh_token to get a new pair before it lapses.
    return payload


if __name__ == "__main__":
    print(json.dumps(create_access_token(), indent=2))

#!/usr/bin/env bash
# Rotate a refresh token for a new access + refresh pair. The old refresh
# token is single-use; replaying a CONSUMED token revokes all refresh tokens
# for that key, so store the new one immediately and only once.
set -euo pipefail

API_BASE="${RADIUMONE_API_BASE:-https://api-sandbox.radiumone.io/gateway}"

curl -sS -X POST "$API_BASE/v1/auth/token/refresh" \
  -H "Content-Type: application/json" \
  -d @request.json

#!/usr/bin/env node
// Rotate a refresh token. Node 18+ ESM fetch.
// Env: RADIUMONE_REFRESH_TOKEN, RADIUMONE_API_BASE (optional override).
import { readFileSync } from "node:fs";

const API_BASE = process.env.RADIUMONE_API_BASE || "https://api-sandbox.radiumone.io/gateway";
const body = JSON.parse(readFileSync(new URL("./request.json", import.meta.url)));
if (process.env.RADIUMONE_REFRESH_TOKEN) body.refresh_token = process.env.RADIUMONE_REFRESH_TOKEN;

async function refreshAccessToken() {
  const res = await fetch(`${API_BASE}/v1/auth/token/refresh`, {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify(body),
  });
  const payload = await res.json();
  if (!res.ok) {
    throw new Error(`auth/token/refresh failed: ${payload.type ?? payload.code} (${res.status})`);
  }
  // Store the NEW refresh_token immediately — the old one is single-use.
  return payload;
}

refreshAccessToken().then((r) => console.log(JSON.stringify(r, null, 2)));

#!/usr/bin/env python3
"""Rotate a refresh token for a new access + refresh pair. Python 3.10+, requests."""
import json
import os
from pathlib import Path

import requests

API_BASE = os.environ.get("RADIUMONE_API_BASE", "https://api-sandbox.radiumone.io/gateway")


def refresh_access_token() -> dict:
    body = json.loads((Path(__file__).parent / "request.json").read_text())
    if os.environ.get("RADIUMONE_REFRESH_TOKEN"):
        body["refresh_token"] = os.environ["RADIUMONE_REFRESH_TOKEN"]

    resp = requests.post(f"{API_BASE}/v1/auth/token/refresh", json=body, timeout=30)
    payload = resp.json()
    if not resp.ok:
        raise RuntimeError(f"auth/token/refresh failed: {payload.get('type') or payload.get('code')} ({resp.status_code})")
    # Store the NEW refresh_token immediately — the old one is single-use.
    return payload


if __name__ == "__main__":
    print(json.dumps(refresh_access_token(), indent=2))