> ## Documentation Index
> Fetch the complete documentation index at: https://fastpay-mintlify-9618a7a2.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Save Melhor Envio OAuth credentials

> Stores the Client ID and Client Secret of the merchant's own Melhor
Envio app. The Client Secret is encrypted at rest and never returned
in API responses.

Must be called before initiating the OAuth flow with
`GET /v1/melhor-envio/oauth/authorize`.



## OpenAPI

````yaml /api-reference/openapi.yaml post /v1/melhor-envio/credentials
openapi: 3.0.0
info:
  title: FastPay API
  version: 1.0.0
  description: >-
    API for creating and managing payment charges.


    ## Authentication


    This API uses **Basic Authentication** for direct API access, such as
    creating charges.

    Use your API key as the username and an empty string as password.

    The header should be formatted as:


    `Authorization: Basic {base64(apiKey:)}`.


    For example:


    ```

    Authorization: Basic YWxleG91dG9uOiIi

    ```


    ## Webhooks


    FastPay sends webhooks to notify your application about charge status
    changes in real-time.

    Webhooks are sent via HTTP POST requests to your configured webhook
    endpoints.


    ### Webhook Events


    The following webhook events are available for charges:


    - `charge.created` - Sent when a new charge is created

    - `charge.pending` - Sent when a charge is pending payment

    - `charge.paid` - Sent when a charge is successfully paid

    - `charge.updated` - Sent when a charge is updated


    ### Webhook Payload Structure


    All webhook payloads follow this structure:


    ```json

    {
      "id": "webhook_event_id",
      "event": "charge.paid",
      "data": {
        // Complete charge object
      }
    }

    ```


    ### Webhook Delivery


    - Webhooks are sent via HTTP POST requests

    - Content-Type: `application/json`

    - Retry logic is implemented for failed deliveries

    - Webhook events are stored in the database for audit purposes

    - Delivery logs are maintained for debugging and monitoring


    ### Webhook Security


    - Webhooks are sent to pre-configured endpoints

    - Endpoints can be enabled/disabled per merchant

    - Event filtering is supported (only receive specific events)

    - Failed deliveries are retried with exponential backoff
servers:
  - url: https://api-global.fastpaybrasil.com
    description: Produção e Sandbox (diferenciados pela API key)
security: []
paths:
  /v1/melhor-envio/credentials:
    post:
      tags:
        - Melhor Envio
      summary: Save Melhor Envio OAuth credentials
      description: |-
        Stores the Client ID and Client Secret of the merchant's own Melhor
        Envio app. The Client Secret is encrypted at rest and never returned
        in API responses.

        Must be called before initiating the OAuth flow with
        `GET /v1/melhor-envio/oauth/authorize`.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - clientId
                - clientSecret
              properties:
                clientId:
                  type: string
                  description: Client ID of the merchant's Melhor Envio app.
                clientSecret:
                  type: string
                  description: Client Secret of the merchant's Melhor Envio app.
      responses:
        '200':
          description: Credentials saved
          content:
            application/json:
              schema:
                type: object
                properties:
                  message:
                    type: string
                    example: Credenciais salvas com sucesso
      security:
        - bearer: []
components:
  securitySchemes:
    bearer:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: |-
        JWT Bearer token authentication. Use the JWT token obtained
        from the login endpoint in the Authorization header as 'Bearer {token}'.

````