Get Token

POST

/authorization/v1/access-token/b2b

Get Access Token is an authentication method to ensure confidentiality, system and data integrity, availability of a system, and as a fraud detection method. It is a mandatory process that is regulated and set mandatory by Bank Indonesia.

Before starting any transaction process involving virtual account, one party need to do get access token activity before hitting the API to the other (e.g merchant want to hit create VA API to DOKU, then merchant need to hit the get access token API and granted the access token.

For Virtual Account use : B2B Token

For Direct Debit use : B2B Token and B2C Token

For e-Wallet use : B2B Token and B2C Token

Request

Header Params

Body Params application/json

Example

{
    "grantType": "client_credentials"
}

Request Code Samples

Shell

JavaScript

Java

Swift

PHP

Python

HTTP

Objective-C

Ruby

OCaml

Dart

curl --location --request POST '/authorization/v1/access-token/b2b' \
--header 'X-CLIENT-KEY: MCH-0008-1296507211683' \
--header 'X-TIMESTAMP: 2024-03-19T14:39:01+07:00' \
--header 'X-SIGNATURE: 85be817c55b2c135157c7e89f52499bf0c25ad6eeebe04a986e8c862561b19a5' \
--header 'content-type: application/json' \
--data-raw '{
    "grantType": "client_credentials"
}'

Responses

🟢200Success

application/json

Headers

Body

Example

{
    "responseCode": "2007300",
    "responseMessage": "Successful",
    "accessToken": "eyJhbGciOiJSUzI1NiJ9.eyJleHAiOjE2NjUxMjc3OTEsIm5iZiI6MTY2NTEyNjg5MSwiaXNzIjoiRE9LVSIsImlhdCI6",
    "tokenType": "Bearer",
    "expiresIn": 900,
    "additionalInfo": ""
}

🟠400Bad Request

Modified at 2025-09-16 10:06:31

Delete Payment Code

Merchant Generate Payment Code