# Get API token

> POST `/token`
> Part of the Payments API reference. Source: https://hub.ozow.com/api-reference/payments-api/post-token/

Server: `https://api.ozow.com` (Production)

Other environments: `https://stagingapi.ozow.com` (Staging)

All requests are authenticated using the token you will receive from this request. The same token can be used for all requests until it expires. The only content type supported by this operation is "application/x-www-form-urlencoded".

## Authentication

- `ApiKey` (API key in the ApiKey header)
  - The unique API key for the merchant. See [Prerequisites and onboarding](../../getting-started/prerequisites-and-onboarding.md) for where to find it.

## Request body

- `grant_type` (string, required, max length 50) - Set as "Password".
- `SiteCode` (string, required, max length 50) - The Ozow site code for the site which the payment is being made to. [Please contact support for SiteCode - support@ozow.com]

## Responses

### 200 OK

**application/json**

- `access_token` (string, required, max length 500) - The token needed for subsequent requests.
- `token_type` (string, required, max length 50) - The token type.
- `expires_in` (string, required, max length 50) - The lifetime of the token in seconds.

**application/xml**

`Token`, the same schema listed in full earlier in this document. Its own page: https://hub.ozow.com/api-reference/payments-api/schemas/token.md

### 401 Unauthorized. The `ApiKey` header is missing or does not match the site, or for a `Secure` operation the bearer token is missing, expired or invalid.

string

Example (example 1):

```json
API key is missing or invalid.
```