> This page is for version v2 (default).
> For other versions, use one of these documentation indexes:
> - v2 (default): https://developers.clearpay.co.uk/v-2/llms.txt
> - v1: https://developers.clearpay.co.uk/v-1/llms.txt

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://developers.clearpay.co.uk/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://developers.clearpay.co.uk/_mcp/server.

# Auth

POST https://global-api-sandbox.afterpay.com/v2/payments/auth
Content-Type: application/json

This endpoint requests a payment auth, which determines the order approval status. If approved, the auth will have an expiration date and time, which is returned in the events list for the "AUTH\_APPROVED" payment event.

This operation is [idempotent](/idempotent-requests) based on the `requestId` (if provided), which allows for the safe retry of multiple requests, guaranteeing the payment operation is only performed once.

The consumer's payment plan begins at the time of auth approval.

Authorisation expires after 13 days and then the transaction is automatically voided. Voided transactions are frozen and cannot be reopened or changed in any way. In this case your only option is to use the v2/checkouts endpoint to create a new order.

## Approved Response (201)

If payment is approved by Clearpay, returns a [Payment object](/payment-object) in response, with a `status` of "APPROVED" and a `paymentState` of "AUTH\_APPROVED".

## Declined Response (402)

If payment is declined by Clearpay, for example, if invalid card details were entered, returns a [Payment object](/payment-object) in response, with a `status` of "DECLINED" and a `paymentState` of "AUTH\_DECLINED".

Please advise the consumer to contact the Clearpay Customer Service team for more information.

## Connection Timeouts

| Timeout | Time (Seconds) |
| :------ | :------------- |
| Open    | 10             |
| Read    | 70             |

## Errors

In addition to the [PUT/POST Errors](/put-post-errors) applicable to all POST endpoints, the following errors are specific to Auth:

| HTTP Status Code              | errorCode                          | Description                                                                            |
| :---------------------------- | :--------------------------------- | :------------------------------------------------------------------------------------- |
| **402**  Payment Required     | `invalid_token`                    | The checkout token is invalid, expired, or does not exist.                             |
| **412**  Precondition Failed  | `invalid_order_transaction_status` | The Consumer has not confirmed their payment for the order associated with this token. |
| **422**  Unprocessable Entity | `invalid_object`                   | The checkout token was missing or empty.                                               |

Reference: https://developers.clearpay.co.uk/deferred-payment-flow/auth

## Authentication

- `Authorization` header (basic auth, required) — Basic authentication of the form `Basic <base64(username:password)>`.

## Request

### Headers

- `Accept` (string, optional, default: application/json)

### Body (application/json)

This endpoint expects an object.

- `token` (string, required) — The token returned in the [Create Checkout](/api-reference/online-api/checkouts/create-checkout) request.
- `requestId` (string, optional) — A unique request ID, required for idempotent retries. It is recommended that the merchant generate a UUID for each unique request.
- `merchantReference` (string, optional) — The merchant’s order id/reference that this payment corresponds to. This will update any value previously provided in the [Create Checkout](/api-reference/online-api/checkouts/create-checkout) request.

## Examples

**Request**

```json
{
  "token": "string"
}
```

**SDK Code**

```python
import requests

url = "https://global-api-sandbox.afterpay.com/v2/payments/auth"

payload = { "token": "string" }
headers = {
    "User-Agent": "User-Agent"
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers, auth=("<username>", "<password>"))

print(response.json())
```

```javascript
const url = 'https://global-api-sandbox.afterpay.com/v2/payments/auth';
const credentials = btoa("<username>:<password>");

const options = {
  method: 'POST',
  headers: {
    'User-Agent': 'User-Agent',
    Authorization: `Basic ${credentials}`,
    'Content-Type': 'application/json'
  },
  body: '{"token":"string"}'
};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}
```

```go
package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://global-api-sandbox.afterpay.com/v2/payments/auth"

	payload := strings.NewReader("{\n  \"token\": \"string\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("User-Agent", "User-Agent")
	req.SetBasicAuth("<username>", "<password>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(res)
	fmt.Println(string(body))

}
```

```ruby
require 'uri'
require 'net/http'

url = URI("https://global-api-sandbox.afterpay.com/v2/payments/auth")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["User-Agent"] = 'User-Agent'
request.basic_auth("<username>", "<password>")
request["Content-Type"] = 'application/json'
request.body = "{\n  \"token\": \"string\"\n}"

response = http.request(request)
puts response.read_body
```

```java
import com.mashape.unirest.http.HttpResponse;
import com.mashape.unirest.http.Unirest;

HttpResponse<String> response = Unirest.post("https://global-api-sandbox.afterpay.com/v2/payments/auth")
  .header("User-Agent", "User-Agent")
  .basicAuth("<username>", "<password>")
  .header("Content-Type", "application/json")
  .body("{\n  \"token\": \"string\"\n}")
  .asString();
```

```php
<?php
require_once('vendor/autoload.php');

$client = new \GuzzleHttp\Client();

$response = $client->request('POST', 'https://global-api-sandbox.afterpay.com/v2/payments/auth', [
  'body' => '{
  "token": "string"
}',
  'headers' => [
    'Content-Type' => 'application/json',
    'User-Agent' => 'User-Agent',
  ],
    'auth' => ['<username>', '<password>'],
]);

echo $response->getBody();
```

```csharp
using RestSharp;
using RestSharp.Authenticators;

var client = new RestClient("https://global-api-sandbox.afterpay.com/v2/payments/auth");
client.Authenticator = new HttpBasicAuthenticator("<username>", "<password>");
var request = new RestRequest(Method.POST);
request.AddHeader("User-Agent", "User-Agent");

request.AddHeader("Content-Type", "application/json");
request.AddParameter("application/json", "{\n  \"token\": \"string\"\n}", ParameterType.RequestBody);
IRestResponse response = client.Execute(request);
```

```swift
import Foundation

let credentials = Data("<username>:<password>".utf8).base64EncodedString()

let headers = [
  "User-Agent": "User-Agent",
  "Authorization": "Basic \(credentials)",
  "Content-Type": "application/json"
]
let parameters = ["token": "string"] as [String : Any]

let postData = JSONSerialization.data(withJSONObject: parameters, options: [])

let request = NSMutableURLRequest(url: NSURL(string: "https://global-api-sandbox.afterpay.com/v2/payments/auth")! as URL,
                                        cachePolicy: .useProtocolCachePolicy,
                                    timeoutInterval: 10.0)
request.httpMethod = "POST"
request.allHTTPHeaderFields = headers
request.httpBody = postData as Data

let session = URLSession.shared
let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in
  if (error != nil) {
    print(error as Any)
  } else {
    let httpResponse = response as? HTTPURLResponse
    print(httpResponse)
  }
})

dataTask.resume()
```