API

API is the screen in the Appmax panel where you get the merchant credentials (client_id and client_secret) for your own store, without going through the app installation flow.

You pick (or create) the store, copy the credentials, and make a single call to /oauth2/token to start using the transactional API.

Who this page is for

For anyone integrating their own store with the Appmax API. If you are building an app that other merchants will install, the installation flow is still the path to follow.

How it differs from the installation flow

The traditional flow exists for the multi-merchant scenario: a third-party app needs authorization from every store that installs it. To integrate your own store, that negotiation isn't necessary.

	Installation flow	API
App credentials	required	not applicable
POST /app/authorize	required	not applicable
Authorization screen with hash	required	not applicable
POST /app/client/generate	required	not applicable
Validation URL (health check)	required	not applicable
Calls until you hold the merchant token	5	1

Before you start

• Access to the Appmax panel with a producer profile.
• The API item visible in the left menu, right below Applications. If it isn't there, contact support: access is granted by permission.

Environment	Panel
Sandbox	https://breakingcode.sandboxappmax.com.br
Production	https://admin.appmax.com.br

Step by step

Open the API screen

In the panel's left menu, click API, right below Applications.

The screen is organized in tabs: Credentials, Webhooks, Documentation and AI guide. The AI guide shows how to use a coding assistant (Claude, ChatGPT, Cursor, Copilot…) in the integration: the context to paste into the conversation — which already tells the assistant to use the panel webhooks, not the Appstore ones —, the .env with the store's Client ID, ready-made prompts and the connection to the documentation MCP.

Create or select the store

On the Credentials tab, click Generate credentials. The form opens in a window over the panel, without leaving the screen. Choose one of two options:

• Create a new store — enter the store name and domain. The name also shows up on your customers' credit card statements. If your account has more than one company, select which one owns the store.
• Use an existing store — select one of the stores you already have at Appmax.

That is the only decision you need to make on this screen. Creating the store, wiring it up and generating the credential pair all happen next, with no manual steps.

Copy the merchant credentials

The store now appears under Merchant credentials, with one card per store. Next to the title is the number of active stores; with more than one store, a search by name also shows up. Beside the list, the How it works block sums up the path to your first call.

Each store's card holds its credentials:

• Client ID — always visible.
• Client Secret — shown only once, at the moment it is generated. After that the field stays masked. Copy it and keep it somewhere safe.
• External ID — the identifier of this installation in the store, used in JS tokenizations.

Losing the secret means generating a new one

The client_secret is not kept for later lookup, nor sent by email. If you lose it, use Generate new secret on the store card: the client_id stays the same, but a new secret is issued and the previous one stops working immediately. Every application using the old secret breaks until you replace it.

Register the webhook URL

Credentials let you call the API. To receive Appmax events (order approved, customer created, refund and others), register a webhook URL.

On the same API screen, open the Webhooks tab and fill in:

1. the store you have just configured;
2. the URL of your endpoint (HTTPS, public);
3. the events you want to receive, grouped into Orders, Payments, Customers and Subscriptions.

The registered webhook shows up in the list right below, where you can test a delivery or delete it.

Logs and advanced rules

The tab covers simple registration. Delivery history, event resend and conditional rules still live in the panel's full webhooks screen.

Delivery format, the full event list and retry rules are covered in Panel webhooks.

Authenticate and transact

With the pair in hand, exchange it for an access_token:

curl --location 'https://auth.appmax.com.br/oauth2/token' \
  --header 'Content-Type: application/x-www-form-urlencoded' \
  --data-urlencode 'grant_type=client_credentials' \
  --data-urlencode 'client_id=YOUR_MERCHANT_CLIENT_ID' \
  --data-urlencode 'client_secret=YOUR_MERCHANT_CLIENT_SECRET'

{
  "access_token": "eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "scope": "customer/create order/create payments/credit-card ..."
}

Use the access_token as a Bearer token on transactional calls:

curl --location 'https://api.appmax.com.br/v1/customers' \
  --header 'Authorization: Bearer YOUR_ACCESS_TOKEN' \
  --header 'Content-Type: application/json' \
  --data '{ "firstname": "Maria", "lastname": "Silva", "email": "[email protected]" }'

The token lasts 1 hour and there is no refresh token: when it expires, repeat the call above. The token's scopes are the ones granted to the app — see Authentication and authorization.

The same example in other languages

The Documentation tab has this flow ready in cURL, Node.js, PHP and Python, with a copy button.

Documentation tab

The Documentation tab gathers, inside the panel, what you need for your first integration:

• Quick start — the four steps to your first call (set up the .env, generate the access token, make the first request and register a webhook) and the code example in cURL, Node.js, PHP and Python. The examples read the credentials from the environment variables APPMAX_AUTH_URL, APPMAX_API_URL, APPMAX_CLIENT_ID and APPMAX_CLIENT_SECRET, so nothing sensitive lives in the code.

• Environments — the API base URL and the authentication URL for each environment, and when to use each one.

  Environment	API base URL	Authentication URL
  Sandbox	https://api.sandboxappmax.com.br	https://auth.sandboxappmax.com.br/oauth2/token
  Production	https://api.appmax.com.br	https://auth.appmax.com.br/oauth2/token

• API reference — shortcuts to the Authentication, Orders, Payments, Customers, Products, Subscriptions, Payment links, Webhooks and Best practices pages, opened in a new tab. The Payments one leads to the overview of credit card, Pix, boleto, Apple Pay and installments.

• Downloads:

  • Postman collection — every API endpoint organized by resource (Authentication, Customers, Orders, Payments, Refunds, Subscriptions, Products, Payment links and Split), already pointing to Sandbox.
  • OpenAPI specification — to generate SDKs or give context to an AI assistant.
  • Integration guide PDF — the full step by step for your own store, in Portuguese: credentials, environments, authentication, first integration, panel webhooks and errors.

Using the Postman collection

1. Import the file into Postman (Import).
2. In the collection variables, fill in client_id and client_secret with the store credentials. Use the Current value, so the secret is not synced to the Postman cloud.
3. Run Authentication → Generate access token: the token is saved in access_token and used by every other request.

For Production, change base_url to https://api.appmax.com.br and auth_url to https://auth.appmax.com.br/oauth2/token.

• Integrate with AI — the Use AI for the integration button opens the AI guide tab, with the context to paste into the assistant, the ready .env and the prompts to generate and review the code.

Never paste the Client Secret into the AI chat

The assistant writes code that reads environment variables. The Client Secret goes straight into the .env, outside the conversation and outside Git.

Managing a store's credentials

Each store card offers two actions, and the difference between them matters:

	Generate new secret	Revoke
client_id	stays the same	ceases to exist
Previous client_secret	stops working immediately	stops working immediately
Live integration	works again once you swap the secret	only with brand new credentials
When to use it	you lost the secret, or rotate it as routine	the secret leaked, or that store's integration was shut down

Revoking

Revoke deletes the client in Appmax's identity provider. From then on, any call to /oauth2/token with that pair returns an authentication error.

Revoking cannot be undone

There is no "un-revoke": the client ceases to exist. For the store to access the API again you must generate new credentials, and in that case the client_id is new too — unlike Generate new secret, which preserves it. Every application for that store must be updated with the new pair.

The revoked store stays in the list, marked as such, offering Generate new credentials. Once confirmed, Appmax issues a new pair — client_id and client_secret — and the card shows the credentials again. As on generation, the client_secret is shown only once: copy it before leaving the screen and update your integration with the new pair.

Revoking does not deactivate the store

Revoking only touches the API credentials. The store stays active on Appmax, selling through checkout and receiving orders as usual — what it loses is programmatic access.

What comes next

• API reference — customers, orders and payments.
• Full integration example — from customer to approved payment.
• Panel webhooks — delivery format and event list.
• Sandbox and production environments — test on sandbox before transacting for real.

FAQ

Does every store have its own credentials? Yes. The pair is per store. If you run several stores, generate credentials for each one and store them separately.

I lost the client_secret. Do I need to create another store? No. Use Generate new secret on the store card: the client_id is preserved and a new secret is issued. Remember the previous one stops working immediately.

I revoked by mistake. How do I undo it? You cannot: the client ceases to exist in the identity provider. Generate new credentials for the same store — the pair will be new, including the client_id, and applications must be updated.

Does revoking deactivate my store? No. The store stays active and selling; only that pair's API access ends.

Do I need app credentials? Not on this path. They exist for whoever installs an app into third-party stores. Here you only use merchant credentials.

Does Appmax send credentials by email? No. No credential is sent by email, chat or any manual channel — they only ever appear on this screen.