Drop developers

Authentication

Merchant systems use OAuth client credentials. Portal passwords are not used for API calls. Keep your client secret on your server and pass the issued bearer token to the Orders API.

Endpoint

POST https://api.dropsa.co.za/oauth/token

Token request

json

{
  "grant_type": "client_credentials",
  "client_id": "drop_app_client_id",
  "client_secret": "drop_app_client_secret"
}

Token response

json

{
  "access_token": "<jwt>",
  "token_type": "Bearer",
  "expires_in": 1800,
  "scope": "orders:create orders:read webhooks:manage"
}

Authenticated request

bash

curl https://api.dropsa.co.za/v1/orders/ord_123 \
  -H "Authorization: Bearer <access_token>"

Implementation notes

The only supported grant type is client_credentials.
Store client secrets in server-side secret management, never in browser code or a mobile app bundle.
Create separate apps and rotate credentials when ownership or security posture changes.