Authentication

Export API uses OAuth2 with the client credentials flow. You obtain an access token from the token endpoint, then send that token with every API request.

Obtaining an access token

This flow follows the OAuth 2.0 client credentials grant as described in RFC 6749 (token endpoint, grant_type=client_credentials, and bearer use of the access token). Behaviour may be restricted to what Export API documents here (e.g. supported grant types and parameters).

Authenticate by requesting a token from the OAuth2 token endpoint. Use POST only (GET is not supported). Send grant_type, client_id, and client_secret in the request body as application/x-www-form-urlencoded. Do not put client_secret (or other credentials) in the URL or query string — query parameters can be logged or cached and are not suitable for secrets.

Token endpoint:

POST https://api.g2a.com/oauth/token
Content-Type: application/x-www-form-urlencoded

Body (form fields):

grant_type=client_credentials&client_id=<your_client_id>&client_secret=<your_client_secret>

Field (body)	Required	Description
grant_type	Yes	Must be client_credentials.
client_id	Yes	Your OAuth2 client ID (issued by G2A).
client_secret	Yes	Your OAuth2 client secret (issued by G2A). Keep it confidential.

Example (curl):

curl -sS -X POST 'https://api.g2a.com/oauth/token' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  --data-urlencode 'grant_type=client_credentials' \
  --data-urlencode 'client_id=<your_client_id>' \
  --data-urlencode 'client_secret=<your_client_secret>'

Example response:

{
  "access_token": "s0k1mdNRxLIK9XJiHVJ7RqibSmKATToh",
  "expires_in": 300,
  "token_type": "bearer"
}

Field	Description
access_token	The token to use in the Authorization header when calling Export API.
expires_in	Token lifetime in seconds (e.g. 300 = 5 minutes). Request a new token before it expires.
token_type	Always bearer. Use it as a Bearer token in the Authorization header.

Sandbox

curl --location 'https://sandboxapi.g2a.com/oauth/token' \
--header 'content-type: application/json' \
--data '{ "grant_type": "client_credentials", "client_id": "ibHtsEljmCxjOFAn", "client_secret": "HrsPmuOlWjqBMHnQWIgfchUqBTBYcRph" }'

Sending requests with the token

All requests to Export API must include the access token in the Authorization header:

Authorization: Bearer <access_token>

Example:

Authorization: Bearer s0k1mdNRxLIK9XJiHVJ7RqibSmKATToh

Use the value of access_token from the token response. After the token expires, obtain a new one and use it in subsequent requests.

Security

• Do not expose OAuth2 client secrets or access tokens in repositories or logs.
• Never send client_secret in the query string; use the POST body only.
• Use environment variables or a secure vault to store secrets.
• Request a new token before the current one expires (expires_in).