Create a Personal Access Token

Creating a token takes a minute and needs no approval from Paysera. This page walks you from an empty account to a working, authenticated request.

Step 1 — Open the token list

Tokens are managed in your Paysera account, not through the API:

1. Sign in at bank.paysera.com.
2. Go to Settings → Access tokens, or open bank.paysera.com/en/personal-access-tokens directly.

note

No Personal Access Token can create, suspend or revoke a token. Those operations need a signed-in session, which is deliberate: a leaked token cannot be used to mint more tokens, to add scopes to itself, or to lift its own expiry or IP restriction. The endpoints behind the interface are not part of this guide and are not reachable with a token.

The one control a token can write is its own spending limit, and only if it has never been written before. See Token controls — it is a reason to set the limits in the form below rather than later.

Step 2 — Configure the token

When you create a token you choose:

Field	Required	Notes
Name	Yes	How you will recognise the token later in the list. Up to 100 characters, and it must not repeat the name of another of your active tokens. A name is free again once the token it belonged to is revoked.
Description	No	Free text — what the token is for.
Scopes	Yes	The operations the token may perform. See Available endpoints.
Accounts	No	Restricts every scope on the token to the accounts you pick. Leave empty to allow all accounts you may access. See Token controls.
Expiry	No	30 days, 90 days, 1 year, a custom date up to 365 days ahead, or never.
Allowed IPs	No	IP addresses or CIDR ranges the token may be used from. IPv6 ranges are not matched — see Token controls.
Spending limits	No	Per-transaction and daily caps, offered when the token carries transfers:create. Set them here — they cannot be changed afterwards, and a token left without a record can have one written by anyone holding it. See Token controls.

Grant the narrowest set of scopes that does the job. A token that only needs to read a balance should carry accounts:read and nothing else.

Step 3 — Copy the token

The token string is shown once, immediately after creation. Copy it into your secret store now — Paysera cannot show it to you again, and there is no "reveal" action in the interface. If you lose it, revoke the token and create a new one.

The token is a JWT and looks roughly like this:

eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJqdGkiOiI4NDkyM2YwYS0uLi4iLCJ0eXAiOiJQQVQi...

Store it as a secret

Put the token in an environment variable, a secret manager or your OS keychain. Never hard-code it, never commit it, and never paste it into a support ticket.

Step 4 — Make your first request

Send the token as a bearer token against https://api.paysera.com. The example below reads the full balance of one of your accounts — replace EVP1234567890 with your own account number.

curl

export PAYSERA_PAT="eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9..."

# --fail-with-body exits non-zero on 4xx/5xx while still printing the reason.
curl -sS --fail-with-body \
  https://api.paysera.com/public/account/rest/v1/accounts/EVP1234567890/full-balance \
  -H "Authorization: Bearer $PAYSERA_PAT"

PHP

$token = getenv('PAYSERA_PAT');

$ch = curl_init('https://api.paysera.com/public/account/rest/v1/accounts/EVP1234567890/full-balance');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, [
    'Authorization: Bearer ' . $token,
]);

$response = curl_exec($ch);
$status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

if ($status !== 200) {
    // The body carries the reason — see "Errors and limits".
    throw new RuntimeException(sprintf('Paysera API returned %d: %s', $status, $response));
}

Python

import os
import requests

token = os.environ['PAYSERA_PAT']

response = requests.get(
    'https://api.paysera.com/public/account/rest/v1/accounts/EVP1234567890/full-balance',
    headers={'Authorization': f'Bearer {token}'},
    timeout=10,
)
response.raise_for_status()

JavaScript

const token = process.env.PAYSERA_PAT;

const response = await fetch(
  'https://api.paysera.com/public/account/rest/v1/accounts/EVP1234567890/full-balance',
  { headers: { Authorization: `Bearer ${token}` } }
);

if (!response.ok) {
  // The body carries the reason — see "Errors and limits".
  throw new Error(`Paysera API returned ${response.status}: ${await response.text()}`);
}

const balance = await response.json();

A 401 here almost always means one of three things: the token string is truncated, the header is missing the Bearer prefix, or the token has expired. See Errors and limits for the full list.

Step 5 — Keep the token healthy

• Suspend a token from the token list if you suspect it leaked but want to keep its configuration.
• Revoke it when the script that used it is retired. Revocation is permanent.
• Check the access log in the token list to see what the token has been doing — method, path, response status and timing per request.

Next steps

• How the token is sent and validated
• Everything a token can call
• Expiry, allowed IPs and spending limits