GoHub Wallet API
Every operation your integration can call. Each one states the credential it takes: a machine token held by your backend, the wallet holder's own token carried by your app, or either.
Authentication
- HTTP: Bearer Auth
- HTTP: Basic Auth
Platform-issued JWT, signed ES256. People get one from POST /auth/login; machines get one from POST /oauth2/token (client_credentials). Both carry the same claim shape, so nothing downstream special-cases them: kind (user or m2m), pop (which population the subject belongs to — WALLET_USER, TENANT_STAFF, PLATFORM_STAFF), tenant (tenant code; absent on platform-scope tokens, which act across tenants), roles, and amr (how the subject proved who they are).
Access tokens are short-lived — refresh at POST /auth/refresh. Every mutation additionally requires an Idempotency-Key header (UUID).
Security Scheme Type: | http |
|---|---|
HTTP Authorization Scheme: | bearer |
Bearer format: | JWT |
Your client_id and client_secret, HTTP Basic. Sending them as form fields also works if your OAuth2 library prefers that.
Security Scheme Type: | http |
|---|---|
HTTP Authorization Scheme: | basic |
Contact
GoHubPay Engineering: engineering@gohubpay.com
License
Proprietary