---
title: "Create a merchant token"
method: POST
path: "/v0.1/merchants/{merchant_code}/tokens"
tags: ["Tokens"]
---

# Create a merchant token

`POST /v0.1/merchants/{merchant_code}/tokens`

## Request

- Base URL: `https://api.sumup.com`
- URL: `https://api.sumup.com/v0.1/merchants/{merchant_code}/tokens`
- Auth: one of:
  - HTTP bearer
  - OAuth 2
    - Authorization code: `https://api.sumup.com/authorize`
    - Token URL: `https://api.sumup.com/token`

Creates a short-lived token for the merchant account identified by `merchant_code` and the requested actions.

Call this endpoint from your backend using a [supported authentication method](https://developer.sumup.com/api/authentication). You must have access to the merchant account. Before returning the token, check that the user signed in to your application is allowed to accept payments for that account.

Pass the returned `access_token` to the SDK. The token expires 15 minutes after creation; use `expires_in` for its remaining lifetime. To continue after it expires, create a new token through this endpoint.

## Path parameters

- `merchant_code` string, required

## Request body

- object
  - `actions` string[], required: Actions the token allows for this merchant account.

## Response `200`

Merchant token created. Pass its access_token to the SDK.

- Token: A short-lived credential for the requested merchant account and actions. Pass access_token to a SumUp SDK that supports merchant tokens.
  - `access_token` string, required: Secret token to pass to the SDK. Treat this value as an opaque string; do not parse it or depend on its format.
  - `token_type` 'Bearer', required: Authentication scheme used by the token. Always Bearer.
  - `expires_in` integer, required: Remaining lifetime of the token in seconds when the response is created. Tokens expire 15 minutes after creation. Request a new token when needed.

## Other responses

- `400`: The request body is invalid or contains unsupported or duplicate actions.
- `401`: Authentication is missing, invalid, or expired.
- `403`: The authenticated identity does not have permission to create tokens for this merchant account.

## Changes

- **2026-11-03** `38138e18acd1`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/sumup/apis/sumup-rest-api/changes/v0.1/merchants/:merchant_code/tokens/post.md)

---

[API](https://skmtc.dev/sumup/apis/sumup-rest-api.md) - [All operations](https://skmtc.dev/sumup/apis/sumup-rest-api/llms.txt) - [OpenAPI document](https://skmtc.dev/sumup/apis/sumup-rest-api/revisions/38138e18acd1?raw)