---
title: "Access Token Exchange"
method: POST
path: "/credentials/accesstoken"
tags: ["Credentials"]
---

# Access Token Exchange

`POST /credentials/accesstoken`

This function is used to request exchanging a Client GUID and Auth Token for an Access Token.

**Integration Methods:**
- Host Direct
- Locally Installed UTG
- Commerce Engine For On Premise
- Commerce Engine For Cloud

See the [Integration Methods](/guides/quickstart#integration-methods) and [URLs Section](/guides/quickstart#urls) sections of the Development Quick Start guide for details regarding each processing option.

## Headers

- `InterfaceVersion` string, required
- `InterfaceName` string, required
- `CompanyName` string, required

## Request body

- object
  - `dateTime` string, ISO 8601, required — The date and time in ISO 8601 format including the timezone offset (yyyy-mm-ddThh:mm:ss.nnn+hh:mm). Must be sent as the local date/time of the merchant. For example, a request processed at a merchant in the Pacific time zone at 9:18am on April 15th 2021 would be sent as 2021-04-15T09:18:23.283-07:00
  - `credential` Credential, required
    - `accessToken` string, uuid — A security credential used to authenticate API requests and all [i4Go®](https://s4-myportal.s3.amazonaws.com/downloads/documentation/i4go/i4go%20technical%20reference%20guide.pdf) authorizeClient/preauthorizeClient requests. An Access Token is the alias for the merchant account and interface being used. The Access Token is required in all requests except an [Access Token Exchange](/apis/payments-platform-rest/openapi/credentials/accesstokenexchange) request, which generates an Access Token using an `authToken` and `clientGuid`.
    - `authToken` string, uuid, required — A unique encrypted identifier that refers to a specific merchant account. It is required when making an [Access Token Exchange](/apis/payments-platform-rest/openapi/credentials/accesstokenexchange) request. For detailed information about the AuthToken, please see [Authentication](/guides/quickstart#access-token-exchange)
    - `clientGuid` string, uuid, required — The Client GUID is a unique identifier that is used to identify an interface across all of the merchant accounts that use it. The same Client GUID can be used for all versions of the same interface. If a completely new interface is certified, then you will receive a new Client GUID, which must be hard coded into the application and must not be a configurable field. The Client GUID is required when making an [Access Token Exchange](/apis/payments-platform-rest/openapi/credentials/accesstokenexchange). For detailed information about the Client GUID, please see [Authentication](/guides/quickstart#access-token-exchange). **Requirement: The Client GUID supplied by your API Analyst must be hard coded into your application because it will permanently identify your interface across all merchant accounts.**
    - `apiSerialNumber` string — The serial number for the merchant account. This field is only used for backwards compatibility with older interfaces and has been replaced by the Access Token.
    - `apiPassword` string — A credential used to authenticate the API Serial Number when processing a request. This field is only used for backwards compatibility with older interfaces and has been replaced by the Access Token.

## Response `200`

AccessToken request was processed

- object
  - `result` object[]
    - `dateTime` string, ISO 8601 — The date and time in ISO 8601 format including the timezone offset (yyyy-mm-ddThh:mm:ss.nnn+hh:mm). Must be sent as the local date/time of the merchant. For example, a request processed at a merchant in the Pacific time zone at 9:18am on April 15th 2021 would be sent as 2021-04-15T09:18:23.283-07:00
    - `credential` object
      - `accessToken` string, uuid — A security credential used to authenticate API requests and all [i4Go®](https://s4-myportal.s3.amazonaws.com/downloads/documentation/i4go/i4go%20technical%20reference%20guide.pdf) authorizeClient/preauthorizeClient requests. An Access Token is the alias for the merchant account and interface being used. The Access Token is required in all requests except an [Access Token Exchange](/apis/payments-platform-rest/openapi/credentials/accesstokenexchange) request, which generates an Access Token using an `authToken` and `clientGuid`.
    - `server` Server
      - `name` string — The name of the server that processed the request.

## Other responses

- `400` — Error
- `504` — Timeout

---

[API](https://skmtc.dev/shift4/apis/shift4-payment-api.md) · [All operations](https://skmtc.dev/shift4/apis/shift4-payment-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/shift4/shift4-payment-api/revisions/2f85c87cc9e5/schema)