---
title: "Access Token"
method: POST
path: "/v1/connect/token"
tags: ["Authentication"]
---

# Access Token

`POST /v1/connect/token`

Request an access token by specifying your `x-client-id` and `x-api-key` in the HTTP request header. The returned `auth_token` is required for all other API endpoints and must be passed in the `x-auth-token` header prefixed with `Bearer ` — for example, `x-auth-token: Bearer <YOUR_TOKEN_HERE>`. The `Bearer ` prefix is required across all business lines.

The access token can be used multiple times for all other API endpoints until it expires. Rely on `expired_at` for the accurate token expiration time.

`auth_token` is valid for **30 minutes** in Production.

### Token concurrency by business line

Whether a newly issued token invalidates the previous one depends on the business line:

- **Multiple tokens may coexist** (newly issued tokens do not invalidate previous ones) — Account Center, Card Issuance.
- **Single active token only** (a newly issued token immediately invalidates the previous one) — Global Account, Global Acquiring, Stablecoin Account.

For single-active-token business lines, avoid requesting new tokens from multiple processes concurrently — running processes may start receiving authentication errors once another process refreshes the token.

## Response `200`

Successfully.

- object
  - `auth_token` string, required — Returned authentication token. Clients must store this securely and destroy it when it is no longer needed.
  - `expired_at` integer, required — Expiration time represented as a Unix timestamp in second-level precision. Indicates the point in time after which the token becomes invalid.

---

[API](https://skmtc.dev/uqpay/apis/authentication-api.md) · [All operations](https://skmtc.dev/uqpay/apis/authentication-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/uqpay/authentication-api/revisions/cef532a10777/schema)