> **Description:** How to use specialized authentication with the Access Token API for partners accessing the Report API or Management API, and for Donations API integrations.

# Specialized authentication

**Not sure which method you need?**

See [Choose your authentication flow](https://developer.vippsmobilepay.com/docs/APIs/access-token-api/README.md#choose-your-authentication-flow) in the Access Token API introduction.

This method applies to:

* Partners accessing the [Report API](https://developer.vippsmobilepay.com/docs/APIs/report-api/README.md) with
  [accounting keys](https://developer.vippsmobilepay.com/docs/partner/partner-keys.md#accounting-keys)
* Anyone integrating with the [Donations API](https://developer.vippsmobilepay.com/docs/APIs/donations-api/README.md) using
  [merchant-level keys](https://developer.vippsmobilepay.com/docs/APIs/donations-api/api-guide.md#how-to-get-the-api-keys)

If none of these apply to you, use [Standard authentication](https://developer.vippsmobilepay.com/docs/APIs/access-token-api/standard-authentication.md) instead.

## Step 1: Get your API keys

After submitting the partner application form, you'll receive
a welcome email with a test sales unit, API keys, documentation links, and an overview of the required steps of the partner onboarding process.

If you have lost this or need a new test sales unit, please contact
[partner@vippsmobilepay.com](mailto:partner@vippsmobilepay.com).
Sales units are unique per country. Remember to state which country the sales unit should be created for.

Note that partner functionality is not available in test. Instead, you will receive merchant API keys, as mentioned in the
[limitations](https://developer.vippsmobilepay.com/docs/knowledge-base/test-environment.md#limitations-of-the-test-environment) section.
All payment flows can be tested using the merchant's API keys.

See [Partner: How to get access for your sales units](https://developer.vippsmobilepay.com/docs/partner/how-to-check-details.md#how-to-get-access-to-your-sales-units).

You generate your own [merchant-level keys](https://developer.vippsmobilepay.com/docs/APIs/donations-api/api-guide.md#how-to-get-the-api-keys).

[Donations integration steps](https://developer.vippsmobilepay.com/docs/APIs/donations-api/api-guide.md)

## Step 2: Request an access token

Call [`POST:/miami/v1/token`](https://developer.vippsmobilepay.com/redocusaurus/access-token-swagger-id.yaml).
This endpoint uses a standard OAuth 2.0 client credentials flow -- you can use any
[trusted OAuth library](https://oauth.net/code/) to perform the flow.

### Encode your keys

Base64-encode your `client_id` and `client_secret` together:

```javascript
const clientId = 'YOUR-CLIENT-ID';
const clientSecret = 'YOUR-CLIENT-SECRET';
const base64Credentials = btoa(`${clientId}:${clientSecret}`);
console.log(base64Credentials);
```

### Send the request

Pass the encoded value in the `Authorization` header:

```bash
curl -X POST https://api.vipps.no/miami/v1/token \
-H 'Authorization: Basic <YOUR-BASE64-ENCODED-VALUE>' \
-H 'Content-Type: application/x-www-form-urlencoded; charset=utf-8' \
--data-urlencode 'grant_type=client_credentials'
```

**WARNING**

You must include `grant_type=client_credentials` or you will get an `invalid_client` error.
Do not include the `Ocp-Apim-Subscription-Key` header.

You may also specify a `scope`:

```bash
curl -X POST https://api.vipps.no/miami/v1/token \
-H 'Authorization: Basic <YOUR-BASE64-ENCODED-VALUE>' \
-H 'Content-Type: application/x-www-form-urlencoded; charset=utf-8' \
--data-urlencode 'grant_type=client_credentials&scope=donations:read'
```

Include the [standard HTTP headers](https://developer.vippsmobilepay.com/docs/knowledge-base/http-headers.md) (e.g. `Vipps-System-Name`,
`Vipps-System-Version`) to help with debugging.

Example response:

```json
{
  "access_token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1Ni <truncated>",
  "token_type": "Bearer",
  "expires_in": 900
}
```

The token is valid for **15 minutes**.

## Step 3: Use the access token

Include the token in the `Authorization` header of every API request:

```bash
curl -X GET API-ENDPOINT-ADDRESS \
-H "Authorization: Bearer YOUR-ACCESS-TOKEN" \
-H "Vipps-System-Name: acme" \
-H "Vipps-System-Version: 3.1.2"
```

**WARNING**

Always include the word `Bearer` before the token. Omitting it will result in an
`HTTP 401 Unauthorized` error. See [HTTP 401 Unauthorized](https://developer.vippsmobilepay.com/docs/knowledge-base/errors.md#http-401-unauthorized).

> **Full site overview:** For every page in this documentation, read [https://developer.vippsmobilepay.com/llms.txt](https://developer.vippsmobilepay.com/llms.txt).