> ## Documentation Index
> Fetch the complete documentation index at: https://docs.commercepay.asia/llms.txt
> Use this file to discover all available pages before exploring further.

# Get Access Token

> The following input parameters are expected to be provided by the Merchant to retrieve the access token.

> - Pass the returned `accessToken` as `Authorization: Bearer {access token from authentication}` on subsequent API calls — see [Request Headers](/docs/request-headers) for the full header list.
> - The token is valid for **24 hours** (`expireInSeconds`: 86400). Cache and reuse it across requests instead of calling this endpoint every time; once it expires, requests using it will be rejected and you'll need to call this endpoint again for a new one.

<Note>
  **No signature required for this call.** Unlike other CommercePay endpoints, Authenticate does not require signature security checking — it's how you obtain the credentials used to sign every other request.
</Note>


## OpenAPI

````yaml /openapi.json post /api/TokenAuth/Authenticate
openapi: 3.0.1
info:
  title: CommercePay API
  version: v1
  description: >
    ---

    **Credentials Accounts**


    Every account is provided with separate keys for testing and for running
    live transactions. Once the merchant application has been approved,
    developers can begin the process of integrating the CommercePay API. The
    following details will be provided to get started with the integration. 


    <a href="https://docs.commercepay.asia/docs/api/d19b0f3289ae0-get-started"
    target="_blank">Get Started</a>
  contact: {}
servers:
  - description: Staging
    url: https://staging-payments.commerce.asia
  - url: https://payments.commerce.asia
    description: Production
security: []
paths:
  /api/TokenAuth/Authenticate:
    parameters: []
    post:
      tags:
        - TokenAuth
      summary: Get Access Token
      description: >-
        The following input parameters are expected to be provided by the
        Merchant to retrieve the access token.


        > - Pass the returned `accessToken` as `Authorization: Bearer {access
        token from authentication}` on subsequent API calls — see [Request
        Headers](/docs/request-headers) for the full header list.

        > - The token is valid for **24 hours** (`expireInSeconds`: 86400).
        Cache and reuse it across requests instead of calling this endpoint
        every time; once it expires, requests using it will be rejected and
        you'll need to call this endpoint again for a new one.
      operationId: ApiTokenauthAuthenticatePost
      parameters:
        - schema:
            type: string
            example: '{1}'
          in: header
          name: Abp-TenantId
          required: true
          description: Fill in provided Merchant Id
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AuthenticateModel'
            examples:
              Example Request:
                value:
                  userNameOrEmailAddress: merchant@yourcompany.com
                  password: your-password
        description: ''
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuthenticateResultModel'
              examples:
                Example Response:
                  value:
                    accessToken: >-
                      eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJtZXJjaGFudCJ9.EXAMPLE_SIGNATURE
                    expireInSeconds: 86400
        '401':
          description: Invalid user name or password
components:
  schemas:
    AuthenticateModel:
      type: object
      additionalProperties: false
      x-internal: false
      required:
        - userNameOrEmailAddress
        - password
      properties:
        userNameOrEmailAddress:
          type: string
          maxLength: 50
          description: >-
            Your merchant account username or email address, provided by
            CommercePay when your account is set up.
          example: merchant@yourcompany.com
        password:
          type: string
          maxLength: 50
          description: >-
            Your merchant account password, provided by CommercePay when your
            account is set up.
          example: your-password
    AuthenticateResultModel:
      type: object
      additionalProperties: false
      x-examples: {}
      x-internal: false
      required:
        - accessToken
      properties:
        accessToken:
          type: string
          description: >-
            Get the access token from the result and place it into the
            Authorization Bearer token type for security purposes.
          nullable: true
        expireInSeconds:
          type: integer
          format: int32
          description: Number of seconds until the access token expires.
          example: 86400

````