Get Access Token
curl --request POST \
--url https://staging-payments.commerce.asia/api/TokenAuth/Authenticate \
--header 'Abp-TenantId: <abp-tenantid>' \
--header 'Content-Type: application/json' \
--data '
{
"userNameOrEmailAddress": "merchant@yourcompany.com",
"password": "your-password"
}
'import requests
url = "https://staging-payments.commerce.asia/api/TokenAuth/Authenticate"
payload = {
"userNameOrEmailAddress": "merchant@yourcompany.com",
"password": "your-password"
}
headers = {
"Abp-TenantId": "<abp-tenantid>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'Abp-TenantId': '<abp-tenantid>', 'Content-Type': 'application/json'},
body: JSON.stringify({userNameOrEmailAddress: 'merchant@yourcompany.com', password: 'your-password'})
};
fetch('https://staging-payments.commerce.asia/api/TokenAuth/Authenticate', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://staging-payments.commerce.asia/api/TokenAuth/Authenticate",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'userNameOrEmailAddress' => 'merchant@yourcompany.com',
'password' => 'your-password'
]),
CURLOPT_HTTPHEADER => [
"Abp-TenantId: <abp-tenantid>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://staging-payments.commerce.asia/api/TokenAuth/Authenticate"
payload := strings.NewReader("{\n \"userNameOrEmailAddress\": \"merchant@yourcompany.com\",\n \"password\": \"your-password\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Abp-TenantId", "<abp-tenantid>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://staging-payments.commerce.asia/api/TokenAuth/Authenticate")
.header("Abp-TenantId", "<abp-tenantid>")
.header("Content-Type", "application/json")
.body("{\n \"userNameOrEmailAddress\": \"merchant@yourcompany.com\",\n \"password\": \"your-password\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://staging-payments.commerce.asia/api/TokenAuth/Authenticate")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Abp-TenantId"] = '<abp-tenantid>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"userNameOrEmailAddress\": \"merchant@yourcompany.com\",\n \"password\": \"your-password\"\n}"
response = http.request(request)
puts response.read_body{
"accessToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJtZXJjaGFudCJ9.EXAMPLE_SIGNATURE",
"expireInSeconds": 86400
}Authentication
Get Access Token
The following input parameters are expected to be provided by the Merchant to retrieve the access token.
- Pass the returned
accessTokenasAuthorization: Bearer {access token from authentication}on subsequent API calls — see Request Headers for the full header list.- The token is valid for 24 hours (
expireInSeconds: 86400).
POST
/
api
/
TokenAuth
/
Authenticate
Get Access Token
curl --request POST \
--url https://staging-payments.commerce.asia/api/TokenAuth/Authenticate \
--header 'Abp-TenantId: <abp-tenantid>' \
--header 'Content-Type: application/json' \
--data '
{
"userNameOrEmailAddress": "merchant@yourcompany.com",
"password": "your-password"
}
'import requests
url = "https://staging-payments.commerce.asia/api/TokenAuth/Authenticate"
payload = {
"userNameOrEmailAddress": "merchant@yourcompany.com",
"password": "your-password"
}
headers = {
"Abp-TenantId": "<abp-tenantid>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'Abp-TenantId': '<abp-tenantid>', 'Content-Type': 'application/json'},
body: JSON.stringify({userNameOrEmailAddress: 'merchant@yourcompany.com', password: 'your-password'})
};
fetch('https://staging-payments.commerce.asia/api/TokenAuth/Authenticate', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://staging-payments.commerce.asia/api/TokenAuth/Authenticate",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'userNameOrEmailAddress' => 'merchant@yourcompany.com',
'password' => 'your-password'
]),
CURLOPT_HTTPHEADER => [
"Abp-TenantId: <abp-tenantid>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://staging-payments.commerce.asia/api/TokenAuth/Authenticate"
payload := strings.NewReader("{\n \"userNameOrEmailAddress\": \"merchant@yourcompany.com\",\n \"password\": \"your-password\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Abp-TenantId", "<abp-tenantid>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://staging-payments.commerce.asia/api/TokenAuth/Authenticate")
.header("Abp-TenantId", "<abp-tenantid>")
.header("Content-Type", "application/json")
.body("{\n \"userNameOrEmailAddress\": \"merchant@yourcompany.com\",\n \"password\": \"your-password\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://staging-payments.commerce.asia/api/TokenAuth/Authenticate")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Abp-TenantId"] = '<abp-tenantid>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"userNameOrEmailAddress\": \"merchant@yourcompany.com\",\n \"password\": \"your-password\"\n}"
response = http.request(request)
puts response.read_body{
"accessToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJtZXJjaGFudCJ9.EXAMPLE_SIGNATURE",
"expireInSeconds": 86400
}No signature required for this call. Unlike other CommercePay endpoints, Authenticate does not require signature security checking — it’s how you obtain the credentials used to sign every other request.
Cache and reuse the access token across requests instead of calling it every time. Once it expires, requests using it will be rejected and you’ll need to call this endpoint again for a new one.
Headers
Your unique Merchant ID assigned by CommercePay.
Body
application/json
Your merchant account username or email address, provided by CommercePay when your account is set up.
Maximum string length:
50Example:
"merchant@yourcompany.com"
Your merchant account password, provided by CommercePay when your account is set up.
Maximum string length:
50Example:
"your-password"
