> ## Documentation Index
> Fetch the complete documentation index at: https://developers.uqpay.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Access Token

> Request an access token by specifying your `x-client-id` and `x-api-key` in the HTTP request header. The returned `auth_token` is required for all other API endpoints and must be passed in the `x-auth-token` header prefixed with `Bearer ` — for example, `x-auth-token: Bearer <YOUR_TOKEN_HERE>`. The `Bearer ` prefix is required across all business lines.

The access token can be used multiple times for all other API endpoints until it expires. Rely on `expired_at` for the accurate token expiration time.

`auth_token` is valid for **30 minutes** in Production.

### Token concurrency by business line

Whether a newly issued token invalidates the previous one depends on the business line:

- **Multiple tokens may coexist** (newly issued tokens do not invalidate previous ones) — Account Center, Card Issuance.
- **Single active token only** (a newly issued token immediately invalidates the previous one) — Global Account, Global Acquiring, Stablecoin Account.

For single-active-token business lines, avoid requesting new tokens from multiple processes concurrently — running processes may start receiving authentication errors once another process refreshes the token.




## OpenAPI

````yaml /account-center/v1.6/access.yaml post /v1/connect/token
openapi: 3.0.2
info:
  version: 0.0.1
  title: Authentication API
  description: >-
    Use API keys to authenticate your client requests when utilizing UQPAY APIs.

    API keys are unique data strings used to authenticate a user and enable
    access to privileged operations on UQPAY APIs. All UQPAY APIs use API keys
    as the mechanism to authenticate client requests. Your API key should be
    kept confidential and secure at all times.
servers:
  - url: https://api-sandbox.uqpaytech.com/api
    description: Sandbox base URL.
  - url: https://api.uqpay.com/api
    description: Production base URL.
security: []
tags:
  - name: Authentication
    description: >-
      Authentication to the API is performed via Bearer Authentication. Provide
      your API key as the basic auth username value. You do not need to provide
      a password.
paths:
  /v1/connect/token:
    post:
      tags:
        - Authentication
      summary: Access Token
      description: >
        Request an access token by specifying your `x-client-id` and `x-api-key`
        in the HTTP request header. The returned `auth_token` is required for
        all other API endpoints and must be passed in the `x-auth-token` header
        prefixed with `Bearer ` — for example, `x-auth-token: Bearer
        <YOUR_TOKEN_HERE>`. The `Bearer ` prefix is required across all business
        lines.


        The access token can be used multiple times for all other API endpoints
        until it expires. Rely on `expired_at` for the accurate token expiration
        time.


        `auth_token` is valid for **30 minutes** in Production.


        ### Token concurrency by business line


        Whether a newly issued token invalidates the previous one depends on the
        business line:


        - **Multiple tokens may coexist** (newly issued tokens do not invalidate
        previous ones) — Account Center, Card Issuance.

        - **Single active token only** (a newly issued token immediately
        invalidates the previous one) — Global Account, Global Acquiring,
        Stablecoin Account.


        For single-active-token business lines, avoid requesting new tokens from
        multiple processes concurrently — running processes may start receiving
        authentication errors once another process refreshes the token.
      operationId: access-token
      responses:
        '200':
          description: Successfully.
          content:
            application/json:
              schema:
                title: AccessTokenResponse
                type: object
                required:
                  - auth_token
                  - expired_at
                properties:
                  auth_token:
                    type: string
                    description: >-
                      Returned authentication token. Clients must store this
                      securely and destroy it when it is no longer needed.
                    example: >-
                      2YotnFZFEjr1zCsicMWpAA2YotnFZFEjr1zCsicMWpAA2YotnFZFEjr1zCsicMWpAA2YotnFZFEjr1zCsicMWpAA
                  expired_at:
                    type: integer
                    description: >-
                      Expiration time represented as a Unix timestamp in
                      second-level precision. Indicates the point in time after
                      which the token becomes invalid.
                    example: 1757449854
      security:
        - XApiKey: []
          XClientId: []
components:
  securitySchemes:
    XApiKey:
      type: apiKey
      in: header
      name: x-api-key
      description: The API key generated by UQPAY.
    XClientId:
      type: apiKey
      in: header
      name: x-client-id
      description: The API client id generated by UQPAY.

````