---
title: "token"
method: POST
path: "/v2/token"
tags: ["Authentication"]
---

# token

`POST /v2/token`

Authenticates API integrators for every Aeropay endpoint.

Returns a transient JSON web token (JWT) to authorize access to the AeroPay API. Tokens last for 30 minutes and are required in the authorization header formatted as: `Bearer {{token}}`.

**Scopes**
The `scope` parameter determines who is acting on the system and which endpoints are available:
* **`merchant`**: Used for merchant calls. To obtain a merchant scoped token, the `id` parameter is required.
* **`userForMerchant`**: Used to act on behalf of users created by your merchant. To obtain a userForMerchant scoped token, an additional `userId` is required along with all merchant credentials (`api_key`, `api_secret`, `id`).

<details>
<summary><strong>Error Glossary</strong> (click to expand)</summary>

| Code | HTTP Status | Message |
|------|-------------|-------------|
| `AP002` | 401 | Invalid API key or secret key |
| `AP006` | 401 | Client not authorized for this scope |
| `AP101` | 401 | No authenticated user |
| `AP700` | 400 | Missing or invalid required parameter |
| `AP701` | 400 | Improperly formatted parameter |

</details>

## Headers

- `Content-Type` string, required

## Request body

- union
  - object
    - `apiKey` string, required
    - `apiSecret` string, required
    - `scope` 'merchant', required — Type of token requested
    - `id` integer, required — Merchant Id. Required for merchant or userForMerchant token.
  - object
    - `apiKey` string, required
    - `apiSecret` string, required
    - `scope` 'userForMerchant', required — Type of token requested
    - `id` integer, required — Merchant Id. Required for merchant or userForMerchant token.
    - `userId` string, required — UUID id of user. Required for userForMerchant token.

## Response `200`

Success - Token generated

- object
  - `TTL` integer
  - `token` string

## Other responses

- `400` — Bad Request - Validation Errors. See examples for common vs. scope-specific errors.
- `401` — Unauthorized - Authentication Failed

---

[API](https://skmtc.net/aero/apis/aeropay-v2-api.md) · [All operations](https://skmtc.net/aero/apis/aeropay-v2-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/aero/aeropay-v2-api/revisions/4700c4ceeaad/schema)