# Get an access token

Building with an AI agent? Start at https://docs.payme.io/agents.md

- Sandbox: `POST https://payme-store-staging.payme.io/api/auth-tokens`
- Production: `POST https://payme-store.payme.io/api/auth-tokens`

## Credentials

No credentials are documented for this endpoint.

Exchanges a seller's MPL and its partner's `payme_client_key` for an access token and a refresh token. Send the access token as `Authorization: Bearer <auth_token>` on every product and customer call.

Only partners can get a token: the seller in `mpl` must belong to the partner whose key you send in `key`. When the access token expires, get a new pair with [`POST /refresh-exchanges`](/products-and-customers/authentication/post-auth-refresh).

Wrong or mismatched credentials return an error; read `status_error_details`. The HTTP status can be `400`, `401` or `500`, depending on how PayMe's core rejects the credentials.

Hosts and the error format: [Hosts, authentication and errors](/products-and-customers/authentication).

## Parameters

This endpoint takes no path, query or header parameters.

## Request body

Content type: `application/json`

The seller and partner credentials.

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `mpl` | string | yes | The seller's MPL (`seller_payme_id`), e.g. `MPLDEMO-MPLDEMO-MPLDEMO-1234567`. The token acts for this seller. |
| `key` | string | yes | The partner's `payme_client_key`. The seller in `mpl` must belong to this partner. |

### Request example

```json
{
  "mpl": "MPLDEMO-MPLDEMO-MPLDEMO-1234567",
  "key": "your_payme_client_key"
}
```

## Code samples

### curl

```bash
curl -X POST 'https://payme-store-staging.payme.io/api/auth-tokens' \
  -H 'Content-Type: application/json' \
  --data-raw '{
  "mpl": "MPLDEMO-MPLDEMO-MPLDEMO-1234567",
  "key": "your_payme_client_key"
}'
```

### Node.js

```javascript
const response = await fetch("https://payme-store-staging.payme.io/api/auth-tokens", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    "mpl": "MPLDEMO-MPLDEMO-MPLDEMO-1234567",
    "key": "your_payme_client_key"
  }),
});

console.log(await response.text());
```

### Python

```python
import requests

response = requests.post(
    "https://payme-store-staging.payme.io/api/auth-tokens",
    json={
        "mpl": "MPLDEMO-MPLDEMO-MPLDEMO-1234567",
        "key": "your_payme_client_key",
    },
)

print(response.text)
```

### PHP

```php
<?php

$body = <<<'BODY'
{
  "mpl": "MPLDEMO-MPLDEMO-MPLDEMO-1234567",
  "key": "your_payme_client_key"
}
BODY;

$ch = curl_init('https://payme-store-staging.payme.io/api/auth-tokens');
curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => $body,
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;
```

## Responses

### 201 — Tokens issued. (success)

| Field | Type | Description |
| --- | --- | --- |
| `auth_token` | string | The access token, a JWT. Send it as `Authorization: Bearer <auth_token>` on product and customer calls. |
| `refresh_token` | string | A single-use token for `POST /refresh-exchanges`, which returns a new pair of tokens. |

```json
{
  "auth_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiI3YzFlNGQ5YSJ9.c2lnbmF0dXJl",
  "refresh_token": "b6f0d3a2-8c41-4e5f-9a7d-2e1c0b9f4a53"
}
```

### 400 — `mpl` or `key` is missing or not a string, or the body isn't valid JSON. Wrong credentials can also return `400`. (error)

| Field | Type | Description |
| --- | --- | --- |
| `status_error_details` | string | What went wrong. Validation messages are in Hebrew unless you send `Accept-Language: en`. |
| `status_error_code` | integer | `501` for a validation error or a body that isn't valid JSON, `999` for any other error. |
| `validation_errors` | object | The fields that failed validation. Each key is a field name; its value maps each failed rule to a message. |
| `session` | string | Trace id of the request. Quote it when you contact PayMe support. |

```json
{
  "status_error_details": "Field validation failed.",
  "validation_errors": {
    "key": {
      "is_not_empty": "The field is required.",
      "is_string": "The value must be a string."
    }
  },
  "status_error_code": 501,
  "session": "f3a1c2b0-9e4d-11ef-8c1a-0242ac120002"
}
```

### 401 — The credentials don't identify a seller of this partner. (error)

| Field | Type | Description |
| --- | --- | --- |
| `status_error_details` | string | What went wrong. |
| `status_error_code` | integer | `999`. |
| `session` | string | Trace id of the request. Quote it when you contact PayMe support. |

```json
{
  "status_error_details": "No Genesis identity found for the credentials",
  "status_error_code": 999,
  "session": "f3a1c2b0-9e4d-11ef-8c1a-0242ac120002"
}
```

### 500 — Server error. Wrong credentials can also return `500`. Contact PayMe support and quote the `session`. (error)

| Field | Type | Description |
| --- | --- | --- |
| `status_error_details` | string | What went wrong. |
| `status_error_code` | integer | `999`. |
| `session` | string | Trace id of the request. Quote it when you contact PayMe support. |