> For the complete documentation index, see [llms.txt](https://pivot-payment.gitbook.io/pivot-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://pivot-payment.gitbook.io/pivot-docs/api-references/api-lists/wallet-account-linkage/authentication.md).

# Authentication

You need to send a request to get an access token to Pivot Server, then you will receive the access token that will expire in 900 seconds (15 minutes). Whenever it expires, you should send another request to get a new access token.

{% hint style="info" %}
**Tips!**

You could create a cron job that generates an access token request that runs every 14 minutes, stores the access token in your system, and uses the access token for every next request.
{% endhint %}

## Access Token B2B

### **Method and URL**

<mark style="color:green;">`POST`</mark> \[<mark style="color:orange;">BASE\_URL</mark>]/snap/v1.0/access-token/b2b

### Request

**Request Header**

<table><thead><tr><th>Key</th><th width="115.1787109375">Data Type</th><th width="131.38671875">Requirement</th><th>Description</th></tr></thead><tbody><tr><td>X-TIMESTAMP</td><td>String</td><td>M</td><td>Client's current local time in yyyy-MMddTHH:mm:ssTZD format</td></tr><tr><td>X-CLIENT-KEY</td><td>String</td><td>M</td><td>Client ID</td></tr><tr><td>X-SIGNATURE</td><td>String</td><td>M</td><td><p>Non-repudiation &#x26; integrity checking:<br>asymmetric signature SHA256withRSA<br><br>X-SIGNATURE: SHA256withRSA<br>(Private_Key, stringToSign) </p><p>stringToSign = client_ID + “|” + X-TIMESTAMP</p></td></tr></tbody></table>

**Request Body**

```json
{
  "grantType": "client_credentials",
  "additionalInfo": {}
}
```

### Response

**Response Body**

```json
{
  "responseCode": "2007300",
  "responseMessage": "Successful",
  "accessToken": "***",
  "tokenType": "Bearer",
  "expiresIn": "900"
}
```

## Access Token B2B2C

### **Method and URL**

<mark style="color:green;">`POST`</mark> \[<mark style="color:orange;">BASE\_URL</mark>]/snap/v1.0/access-token/b2b2c

### Request

**Request Header**

<table><thead><tr><th>Key</th><th width="115.1787109375">Data Type</th><th width="131.38671875">Requirement</th><th>Description</th></tr></thead><tbody><tr><td>X-TIMESTAMP</td><td>String</td><td>M</td><td>Client's current local time in yyyy-MMddTHH:mm:ssTZD format</td></tr><tr><td>X-CLIENT-KEY</td><td>String</td><td>M</td><td>Client ID</td></tr><tr><td>X-SIGNATURE</td><td>String</td><td>M</td><td><p>Non-repudiation &#x26; integrity checking:<br>asymmetric signature SHA256withRSA<br><br>X-SIGNATURE : SHA256withRSA</p><p>(Private_Key, stringToSign) </p><p>stringToSign = client_ID + “|” + X-TIMESTAMP</p></td></tr></tbody></table>

**Request Body**

```json
{
 "grantType":"authorization_code",
 "authCode":"{{bindingId}}", // obtained from account creation and binding callback
 "refreshToken":"{{customerRefreshToken}}",
 "additionalInfo":{
 }
}
```

### Response

**Response Body**

```json
{
  "accessToken": "***",
  "accessTokenExpiryTime": "2025-11-27T10:46:03+07:00",
  "refreshToken": "***",
  "refreshTokenExpiryTime": "2025-11-26T10:46:03+07:00",
  "responseCode": "2007400",
  "responseMessage": "Successful",
  "tokenType": "Bearer"
}
```