# Create Token API

- Anchor: `bankhub-en-api-tao-token`
- URL: https://developer.sepay.vn/en/bankhub/api/tao-token.md
- Description: This API generates an access token (bearer token) used to authenticate other Bank Hub APIs. The token has a limited lifetime and must be refreshed when it expires.

**POST** `https://bankhub-api-sandbox.sepay.vn/v1/token`
```http
Authorization: Basic {base64(client_id:client_secret)}
Content-Type: application/json
```



* This API generates an access token to authenticate other Bank Hub APIs.
* The returned token has a limited lifetime (TTL).
* Uses **Basic Authentication** with `client_id` and `client_secret` provided by SePay.

<!-- Params table -->

> **Notes** (info)
>
>
> * Use **Basic Authentication**: Base64-encode the string `client_id:client_secret` and set it in the header `Authorization: Basic {base64_string}`
> * Send the request with an empty body
> * The access token is valid for the duration specified by `ttl` (in seconds)
> * When the token expires, call this API again to obtain a new token
>

| Code | Name | Description |
|------|------|-------------|
| 401 | Unauthenticated | Invalid or disabled Client ID / Client Secret |






**RESPONSE 201**


```json
{
  "code": 201,
  "access_token": "5e79079684d93027ed1d7e414b04543b1d6ef164",
  "ttl": 60000
}
```





**RESPONSE 401 - Authentication Error**


```json
{
  "code": 401,
  "message": "Unauthenticated"
}
```








---

### Using the Access Token

* After obtaining `access_token`, include it in the `Authorization` header using the `Bearer` scheme for all other Bank Hub APIs:
  

### Refreshing the Token

* The token has a limited lifetime (defined by `ttl`). When the token expires, APIs will return `401 Unauthorized`. In that case, you should:

* Call `/v1/token` again to obtain a new token

* Update the token in your system

* Continue calling subsequent APIs using the new token

> **Notes** (warn)
>
>
> * Store the token securely and never expose it on the client side
> * Implement an automatic token refresh mechanism before expiration
> * Handle 401 errors by fetching a new token automatically and retrying the request
>

---