Skip to main content

Overview

The NTX Pay Mexico API uses two-layer authentication:
  1. Certificate — delivered by NTX Pay during onboarding, proves the identity of the client server.
  2. OAuth 2.0 client_credentialsclientId + clientSecret provided during onboarding, validated together with the certificate.
The combination returns a JWT (valid for 10 minutes) used on the remaining endpoints as Authorization: Bearer ....
Authentication in the sandbox is identical — what changes is the certificate + clientId/clientSecret pair, which is distinct from production. Production credentials against https://sandbox.mx.ntxpay.com return 401.

Endpoint

POST /api/auth/token

Required Headers

The X-SSL-Client-Cert header is typically injected by NGINX/ALB with the URL-encoded certificate:
In development, URL-encode it manually:

Request

Response (201)

Using the Token

Include the access_token in every authenticated request:

Renewal

The token expires in 10 minutes (600s). Repeat step 1 before it expires — there is no refresh token.
Do not cache the token across processes without an invalidation mechanism. Under high load, generate one token per worker and renew every ~8 minutes to avoid 401 errors due to expiration.

Common Errors

Code Examples

Next Steps

Balance Query

Apply the Bearer token and query the account balance

SPEI Cash-In

Create your first SPEI charge