client.getCredentials()

Use this method to read the credentials the SDK holds for the connected customer, so you can forward the accessToken to your own backend and call the MoonPay Platform API server-side on that customer’s behalf. This is an advanced escape hatch. The SDK normally keeps credentials internal and authenticates its own calls (such as getQuote() or getPaymentMethods()) for you. Reach for getCredentials() only when you need to act as the connected customer from your backend, for example to fetch quotes server-side. If the SDK already exposes a method for what you need, use that method instead.

getCredentials() is synchronous. It returns a Result directly, not a Promise, so you do not await it. Every other client method that talks to MoonPay is async.

getCredentials() reads credentials that the connection flow already populated. Establish a connection first with client.getConnection(), and where needed client.connect() or client.setupAuth(). Until a connected-customer accessToken exists, the method returns err({ code: "noActiveSession" }). A guest or connectionRequired session that only holds a clientToken still returns noActiveSession.

Read credentials and call your backend

import { createClient } from "@moonpay/platform-sdk-web";

const client = createClient({ sessionToken: "c3N0XzAwMQ==" });

// Establish a connected-customer session first.
const connection = await client.getConnection();
if (!connection.ok || connection.value.status !== "active") {
  // Run client.connect() or client.setupAuth() before reading credentials.
  return;
}

// Synchronous: no await.
const result = client.getCredentials();

if (!result.ok) {
  if (result.error.code === "noActiveSession") {
    // No connected-customer access token yet. Complete the connect flow first.
    console.error(result.error.message);
  }
  return;
}

// Forward the access token to your own backend over HTTPS.
await fetch("https://api.your-backend.example/quotes", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({ accessToken: result.value.accessToken }),
});

Fetch quotes from your backend

The supported use case is backend-driven, customer-scoped quoting. Your backend uses the customer’s accessToken as a Bearer token against the Platform API, which is the same authentication the SDK uses internally. See Client-side authentication for the header format.

Backend: quote as the connected customer

// Backend, Bearer accessToken forwarded from the client
const quote = await fetch("https://api.moonpay.com/platform/v1/quotes", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    // Same auth the SDK uses internally, scoped to the connected customer.
    Authorization: `Bearer ${accessToken}`,
  },
  body: JSON.stringify({
    source: { asset: { code: "USD" }, amount: "100.00" },
    destination: { asset: { code: "ETH" } },
    wallet: { address: "0x1234567890123456789012345678901234567890" },
    paymentMethod: { type: "apple_pay" },
  }),
});

The accessToken is a bearer credential, short-lived and scoped to one connected customer. Send it only to your own backend over HTTPS. Don’t log it or persist it long-term. Your backend uses it as a Bearer token against the Platform API.

Parameters

client.getCredentials() takes no arguments.

Result

client.getCredentials() returns a Result<Credentials, GetCredentialsError> synchronously.

Result envelope

Result<Credentials, GetCredentialsError>

Field	Type	Required	Description
`ok`	`boolean`	✅	Whether the operation succeeded.
`value`	`Credentials`		Present when `ok` is `true`.
`error`	`GetCredentialsError`		Present when `ok` is `false`.

`Credentials`

The tokens the SDK holds for the connected customer. For how these tokens are issued and scoped, see Client credentials.

Field	Type	Required	Description
`accessToken`	`string`	✅	A short-lived bearer token scoped to the connected customer. Forward it to your own backend to call the Platform API on the customer’s behalf.
`clientToken`	`string`	✅	A token identifying the SDK client, used when launching frames. The SDK uses it internally; you rarely need it directly.

`GetCredentialsError`

GetCredentialsError covers the case where no connected-customer session exists yet.

Field	Type	Required	Description
`code`	`"noActiveSession"`	✅	There is no connected-customer access token yet. Complete the connect flow before reading credentials.
`message`	`string`	✅	A developer-friendly description of the failure.

types.ts

type Credentials = {
  accessToken: string;
  clientToken: string;
};

type GetCredentialsError = {
  code: "noActiveSession";
  message: string;
};

Credentials and GetCredentialsError are exported from @moonpay/platform-sdk-web.

Overview

Customers

Payments

Integration essentials

SDK Reference

Frames

Fetch quotes from your backend

Parameters

Result

Result envelope

`Credentials`

`GetCredentialsError`

​Fetch quotes from your backend

​Parameters

​Result

​Result envelope

​Credentials

​GetCredentialsError

Fetch quotes from your backend

Parameters

Result

Result envelope

`Credentials`

`GetCredentialsError`