> ## Documentation Index
> Fetch the complete documentation index at: https://docs.laikipay.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> How to authenticate requests to the LaikiPay Developer API

# Authentication

LaikiPayenforces a single, unified, zero-trust authentication architecture: **Token-Based Bearer Authentication**.

All API operations (virtual cards, balance queries, funding, spend limits, and transactions) authenticate using short-lived **15-minute Bearer Access Tokens** issued by the LaikiPaytoken service.

***

## Authentication Flow Overview

```
1. Authenticate & Obtain Token
   POST /v1/merchant/auth/token
   Body: { merchantId, secretKey }
             │
             ▼
   Returns: { accessToken, expiresIn: 900, tokenType: "Bearer" }

2. Execute API Calls
   GET /v1/merchant/cards/config
   POST /v1/merchant/cards
   Header: Authorization: Bearer <accessToken>
```

***

## Step 1: Obtain a 15-Minute Access Token

To interact with the API, exchange your **Merchant ID** and **Secret Key** for a short-lived access token:

### Request

```http theme={null}
POST https://api.laikipay.com/v1/merchant/auth/token
Content-Type: application/json
```

```json Request Body theme={null}
{
  "merchantId": "mid_lk_9a4f21e0b8c4d29a",
  "secretKey": "sk_test_9401ab38f8219cb7d4e320f0a82"
}
```

<CodeGroup>
  ```bash cURL theme={null}
  curl -X POST "https://api.laikipay.com/v1/merchant/auth/token" \
    -H "Content-Type: application/json" \
    -d '{
      "merchantId": "mid_lk_9a4f21e0b8c4d29a",
      "secretKey": "sk_test_9401ab38f8219cb7d4e320f0a82"
    }'
  ```

  ```javascript Node.js theme={null}
  const tokenResponse = await fetch('https://api.laikipay.com/v1/merchant/auth/token', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({
      merchantId: 'mid_lk_9a4f21e0b8c4d29a',
      secretKey: 'sk_test_9401ab38f8219cb7d4e320f0a82',
    }),
  });

  const { data } = await tokenResponse.json();
  const accessToken = data.accessToken;
  ```

  ```python Python theme={null}
  import requests

  res = requests.post(
      "https://api.laikipay.com/v1/merchant/auth/token",
      json={
          "merchantId": "mid_lk_9a4f21e0b8c4d29a",
          "secretKey": "sk_test_9401ab38f8219cb7d4e320f0a82"
      }
  )
  access_token = res.json()["data"]["accessToken"]
  ```
</CodeGroup>

### Response (`200 OK`)

```json theme={null}
{
  "status": "success",
  "data": {
    "accessToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJjbXJjXzAxIiwibWVyY2hhbnRJZCI6Im1pZF9sayIsImVudmlyb25tZW50IjoiVEVTVCIsInR5cGUiOiJtZXJjaGFudF9hcGlfdG9rZW4ifQ...",
    "tokenType": "Bearer",
    "expiresIn": 900,
    "environment": "TEST",
    "merchantId": "mid_lk_9a4f21e0b8c4d29a"
  },
  "timestamp": "2026-10-12T07:10:00.000Z",
  "path": "/v1/merchant/auth/token"
}
```

***

## Step 2: Authorize Subsequent Requests

Provide the generated `accessToken` in the `Authorization` header of every API request:

```http theme={null}
Authorization: Bearer <accessToken>
```

```bash cURL Example theme={null}
curl -X GET "https://api.laikipay.com/v1/merchant/cards/config" \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
```

***

## Token Lifecycle & Auto-Refresh

* **Validity Period**: Access tokens are valid for **15 minutes (900 seconds)** from creation.
* **Auto-Refresh Best Practice**: Cache the `accessToken` in your application memory or Redis cache with an expiration of 14 minutes. When expired, invoke `POST /v1/merchant/auth/token` again to fetch a fresh token.
* **Stateless & Scalable**: Ephemeral tokens eliminate the security risk of keeping long-lived credentials in distributed containers or serverless instances.

***


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.