> **Description:** How to use standard authentication with the Access Token API to get a Bearer token for your API requests.

# Standard authentication

**Not sure which method you need?**

See [Choose your authentication flow](https://developer.vippsmobilepay.com/docs/APIs/access-token-api/README.md#choose-your-authentication-flow) in the Access Token API introduction.

This is the authentication method used by the vast majority of integrations.

If you are a **partner** who needs access to the Report API or Management API, or if you are integrating
with the Donations API, use [Specialized authentication](https://developer.vippsmobilepay.com/docs/APIs/access-token-api/specialized-authentication.md) instead.

## Step 1: Get your API keys

You need the [sales unit API keys](https://developer.vippsmobilepay.com/docs/knowledge-base/api-keys.md) for the
sales unit you are integrating with.

## Step 2: Request an access token

Call [`POST:/accesstoken/get`][access-token-endpoint] with your API keys in the request headers:

* `client_id` -- Client ID for the sales unit.
* `client_secret` -- Client secret for the sales unit.
* `Ocp-Apim-Subscription-Key` -- Subscription key for the sales unit.

Example request:

```text
client_id: YOUR-CLIENT-ID
client_secret: YOUR-CLIENT-SECRET
Ocp-Apim-Subscription-Key: YOUR-SUBSCRIPTION-KEY
Merchant-Serial-Number: 123456
Vipps-System-Name: acme
Vipps-System-Version: 3.1.2
Vipps-System-Plugin-Name: acme-webshop
Vipps-System-Plugin-Version: 4.5.6
```

Example response:

```json
{
  "token_type": "Bearer",
  "expires_in": "86398",
  "expires_on": "1495271273",
  "access_token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1Ni <truncated>"
}
```

| Field | Description |
| --- | --- |
| `token_type` | Always `Bearer`. Include this word when using the token. |
| `expires_in` | Validity period in seconds. |
| `expires_on` | Expiry time as a Unix timestamp (UTC). |
| `access_token` | The token to include in subsequent API requests. |

The token is valid for **1 hour** in the test environment and **24 hours** in production.
You can request tokens in advance, reuse them for their full validity period, and hold multiple valid tokens at the same time.

## Step 3: Use the access token

Include the token in the `Authorization` header of every API request:

```text
Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1Ni <truncated>
Ocp-Apim-Subscription-Key: YOUR-SUBSCRIPTION-KEY
Merchant-Serial-Number: 123456
Vipps-System-Name: acme
Vipps-System-Version: 3.1.2
Vipps-System-Plugin-Name: acme-webshop
Vipps-System-Plugin-Version: 4.5.6
```

Many of these headers are optional during testing, but include them in your integration so that
error information can be found in the logs.

**WARNING**

Always include the word `Bearer` before the token. Omitting it will result in an
`HTTP 401 Unauthorized` error. See [HTTP 401 Unauthorized](https://developer.vippsmobilepay.com/docs/knowledge-base/errors.md#http-401-unauthorized).

[access-token-endpoint]: https://developer.vippsmobilepay.com/redocusaurus/access-token-swagger-id.yaml

> **Full site overview:** For every page in this documentation, read [https://developer.vippsmobilepay.com/llms.txt](https://developer.vippsmobilepay.com/llms.txt).