Login İşlemleri

Kullanıcı Doğrulama ve Yetkilendirme (Authorize) Başlatma

post

https://api.iyzipay.comhttps://sandbox-api.iyzipay.com

/in-store/oauth2/authorize

Bu servis authorization aşamasını başlatır ve "auth code" üretir.

Akış:

1. Bu servise form-urlencoded body ile istek atılır.

2. Yanıttaki "code" değeri alınır.

3. Alınan "code" değeri, token üretmek için "Get Token with Auth Code" servisinde kullanılır.

Body

application/x-www-form-urlencoded

scopestring · enumRequired

Default değer: iyzipayApiGateway

Possible values:

client_idstringRequired

iyzico tarafından sağlanan merchant özelinde clientid değeri.

client_secretstringRequired

iyzico tarafından üretilen merchant özelinde client secret değeri.

response_typestring · enumRequired

Default değer; code

Possible values:

usernamestringRequired

Kullanıcı Adı

passwordstringRequired

Kullanıcı şifre

request_timestampstringRequired

İlgili requestin gönderildiği unix timestamp değeri.

Responses

200Success

application/json

401Error

application/json

post

/in-store/oauth2/authorize

HTTPcURLJavaScriptPython

POST /in-store/oauth2/authorize HTTP/1.1
Host: api.iyzipay.com
Content-Type: application/x-www-form-urlencoded
Accept: */*
Content-Length: 189

"scope='iyzipayApiGateway'&client_id='cclient_id'&client_secret='client_secret'&response_type='code'&username='username'&password='password'&request_timestamp='1755677361682'"

{
  "code": "O6C8tPb0iHee-V_2Kr1stc3AGNzCMziBHjeEmQSgkz7nGuEMeu01ZfvkJSRIEpW0RbtooPNX1YRw_4cGaxVD6ENXPjc01IrnO-REiuzkvjdeYOXDclwZMx-KlJU8rC3n",
  "issuedAt": "2025-12-25T14:05:49.379055098+03:00",
  "expiredAt": "2025-12-25T14:15:49.379055098+03:00"
}

Örnek Collection

Postman

Get Token with Auth Code / Refresh Token

post

https://api.iyzipay.comhttps://sandbox-api.iyzipay.com

/in-store/oauth2/token

Bu servis, auth code kullanarak access_token ve refresh_token üretir.

Authorization (Basic Auth):

• Username: client_id

• Password: client_secret Header formatı: Authorization: Basic base64(client_id:client_secret)

Akış (Auth Code):

1. /authorize çağrısından dönen "code" alınır.

2. Bu servise form-urlencoded body ile gönderilir:

   • grant_type=authorization_code

   • code={authCode}

3. Response içinden:

   • access_token: Terminal Host servislerinde Bearer Token olarak kullanılır.

   • refresh_token: Token yenileme için saklanır.

   • expires_in: access_token geçerlilik süresi (sn).

Authorizations

BasicAuth

AuthorizationstringRequired

Basic Auth ile yetkilendirme. Postman Basic Auth alanları:

• Username: client_id
• Password: client_secret

HTTP header karşılığı: Authorization: Basic base64(client_id:client_secret)

Body

application/x-www-form-urlencoded

or

Responses

200Success

application/json

400Error

application/json

401Error

application/json

post

/in-store/oauth2/token

HTTPcURLJavaScriptPython

POST /in-store/oauth2/token HTTP/1.1
Host: api.iyzipay.com
Authorization: Basic username:password
Content-Type: application/x-www-form-urlencoded
Accept: */*
Content-Length: 57

"grant_type='authorization_code'&code='{{authCode}}'"

Get Token with Auth CodeGet Token with Refresh Token

{
  "access_token": "eyJraWQiOiI4M2Q0NDExYy05M2EzLTRiOWQtOGUwYi0xM2JjZGYxMGZmNTYiLCJhbGciOiJSUzI1NiJ9.eyJzdWIiOiJ1c2VyMSIsImRldmljZU1lbWJlcklkIjoyLCJpc3MiOiJodHRwOi8vMTcyLjIzLjMwLjIyOTo4MDgwIiwiYXV0aG9yaXRpZXMiOlsicG9zX29wZXJhdGlvbnMiXSwiYXVkIjoibWVyY2hhbnQtMS1lY3IxLWludGVncmF0aW9uIiwibmJmIjoxNzY4MjI5NzQ0LCJzY29wZSI6WyJpeXppcGF5QXBpR2F0ZXdheSJdLCJhdXRoRGV2aWNlSWQiOjE0LCJkZXZpY2VNZW1iZXJUeXBlIjoiRUNSX0hPU1QiLCJzaWduaW5nS2V5IjoiUmVKSFpEdTFjMDBxWWFzRjVIZnNYYTJoMENTQ28wNUQiLCJleHAiOjE3NjgyMzY5NDQsImlhdCI6MTc2ODIyOTc0NCwianRpIjoiYzdhMTcwNjctMjEwNC00OGZkLTk5NDMtNzRhNGYwNWYyNGQwIn0.T_fY-zWb3Rw5xdarMHKwX9OKMXEkFoI70o7N1y14cllCB3tOFTp__TDY1rzKU23eaw6dPDHpUSP09eWGJI2XVyhus0hDLwBVyNkObDXPn3DIu55Of0GcfnHi4ic13cpsGG3-M3dg7ri_JSIGle4MkPrRqYXcKVcp4A9mawFnWcWqecdgYJlcQPbwuINXCAUOpQBROg0EEqvuNJwVlQk4aUwm4hgveboGXPAymvc3AbJNzqlljvKrawXRULKcZPFGe8mKFgkUtsvLpYrVhLaQHttAmFKsKmOwDQbugWtZ7jFrGJQPIC6d1Wgkb2xz9gPKB0ic5NIf-tS2hM4lPKQOhw",
  "refresh_token": "HKi_OISDcC451HdL90Nb2FzGrrjFEKzOQCSr3dgYRbe76OCi5zRr7dXaVmCTqTPDnqFdSP-MyDrCXMSAtbrUTRRgy11ZqLToARRyJqpCPpujFqabsRzLqoshKTBaKib",
  "scope": "iyzipayApiGateway",
  "token_type": "Bearer",
  "expires_in": 7199
}

Örnek Collection

Auth Code

Refresh Token