> **Description:** An introduction to how authentication works for Vipps MobilePay APIs, and where to find implementation details.

# Authentication and authorization

To use our APIs, your identity must be verified (authentication) and your access rights confirmed (authorization). Your [API keys](https://developer.vippsmobilepay.com/docs/knowledge-base/api-keys.md) are your credentials -- keep them secret.

For most APIs, you exchange your API keys for a short-lived access token, then include that token in every API request.

```mermaid
sequenceDiagram
    participant You as Your integration
    participant ATX as Access Token API
    participant API as Other APIs

    You->>ATX: Send access token request with API keys
    ATX-->>You: Access Token API returns an access token
    You->>API: Send API requests with authorization token
    API-->>You: API returns a response
```

  Your integration sends a request with API keys to the Access Token API.
  Access Token API returns an access token.
  Your integration sends an API request with the token in the Authorization header.
  The API returns a response.

When you're ready to implement, see the [Access Token API](https://developer.vippsmobilepay.com/docs/APIs/access-token-api/README.md) to identify which method applies to you.

> **Full site overview:** For every page in this documentation, read [https://developer.vippsmobilepay.com/llms.txt](https://developer.vippsmobilepay.com/llms.txt).