Skip to content
Demo environment. M-Pesa and DMVIC are simulated; no real money or certificates move. Sandbox details
FlexySure
Sign in

Authentication

1 endpoint · base URL https://flexysure.intrepidprojects.co.ke/api/v1

Flexysure issues short-lived bearer tokens to API clients created on Settings → API keys. Request a token with the OAuth2 client-credentials grant, then send it as Authorization: Bearer <token> on every call. Tokens carry scopes; a request outside the token's scopes gets a 403 insufficient_scope problem. A token never does more than its key currently allows: removing a scope from the key in Settings applies to tokens already issued. Tokens of a suspended organisation get 401 tenant_inactive; a key whose actor user is disabled gets 401 actor_disabled. Writes are checked against the acting user's abilities (the agent, the key's actor user, or the key's creator): 403 actor_forbidden when that user may not do it. Every response carries X-Request-Id; quote it when you contact support.

MethodPathSummaryScope
POST /api/v1/oauth/token Get an access token —
POST /api/v1/oauth/token

Get an access token

Exchanges a client id and secret for a bearer token (default lifetime 24 hours). Accepts a JSON or form body with grant_type=client_credentials, client_id, client_secret and an optional space-separated scope; HTTP Basic client authentication; or, for Insurance Cloud migrations, the body {"key": "...", "passkey": "..."}. When scope is omitted the token carries every scope the client is allowed.

Scope
None
Authentication
None (client credentials in the body)
Rate limit
10 requests per minute per IP address
Idempotency
Not keyed. Check before retrying.

Headers

HeaderMeaning
Content-Typeapplication/json or application/x-www-form-urlencoded

Body fields

FieldTypeRequiredDescription
grant_type string No Must be client_credentials (default). Example: client_credentials
client_id string Yes Public client id from Settings → API keys (fx_live_…). Example: fx_live_3fK9aQ2bX8mN1pL4rS6tU0vW
client_secret string Yes The secret shown once when the key was created or rotated.
scope string No Space-separated subset of the client's scopes. Example: read quote bind
key string No Insurance Cloud alias for client_id.
passkey string No Insurance Cloud alias for client_secret.

Example

Request cURL 
curl -X POST 'https://flexysure.intrepidprojects.co.ke/api/v1/oauth/token' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "grant_type": "client_credentials",
    "client_id": "fx_live_3fK9aQ2bX8mN1pL4rS6tU0vW",
    "client_secret": "fxs_…",
    "scope": "read quote bind"
}'
Request body (JSON)
Request body JSON 
{
    "grant_type": "client_credentials",
    "client_id": "fx_live_3fK9aQ2bX8mN1pL4rS6tU0vW",
    "client_secret": "fxs_…",
    "scope": "read quote bind"
}
Response JSON 
{
    "access_token": "e3mT…48 characters…",
    "token_type": "Bearer",
    "expires_in": 86400,
    "scope": "read quote bind"
}

Responses

StatusMeaning
200 Token issued
400 invalid_request, invalid_scope or unsupported_grant_type
401 invalid_client: unknown client id, wrong secret, or revoked client
403 tenant_inactive: the organisation is suspended or still in KYC review
429 rate_limited: more than 10 attempts a minute from one IP

Errors are problem documents; the common codes (401, 403 insufficient_scope, 422, 429) apply to every endpoint.