Access token FAQ
Work with these docs in your editor
Our plugin gives your assistant up-to-date guidance for payments and login. Full instructions
Run both commands, in order.
claude plugin marketplace add vippsas/agent-toolkitclaude plugin install vipps@agent-toolkitWhat do I do if I've compromised the keys?​
- Merchants
- Partners
If you accidentally share your sales unit API keys, you must generate new ones by clicking the regenerate button on your business portal sales unit page. See How to regenerate API keys for step-by-step instructions.
For keys other than a merchant's sales unit API keys, contact the partner team. For a merchant's sales unit keys, the merchant needs to generate new ones on the business portal. See How to regenerate API keys for step-by-step instructions.
Update your integrations so they will continue working.
Why are there two endpoints?​
The new token endpoint follows a fully standard OAuth client credentials flow, which means you can use any of the trusted OAuth libraries to handle token management. We are working towards making this endpoint available for more APIs and use cases over time.
In the meantime, the original accesstoken endpoint continues to work as before, so existing integrations are not affected.
How long is an access token valid?​
With POST:/accesstoken/get, the access token is valid for 1 hour in the test environment
and 24 hours in the production environment.
With POST:/miami/v1/token, the access token is valid for 15 minutes regardless of the environment.