--- title: "Create a merchant token" description: "Creates a short-lived token for the merchant account identified by `merchant_code` and the requested actions.\n\nCall this endpoint from your backend using a [supported authentication method](https://developer.sumup.com/api/authentication). You must have access to the merchant account. Before returning the token, check that the user signed in to your application is allowed to accept payments for that account.\n\nPass the returned `access_token` to the SDK. The token expires 15 minutes after creation; use `expires_in` for its remaining lifetime. To continue after it expires, create a new token through this endpoint.\n\n**Required permissions:**\n\n- `{\"relation\":\"tokens.create\",\"object_type\":\"merchant\",\"object_id_param\":\"merchant_code\"}`" image: "https://developer.sumup.com/og/index.png" --- > Documentation Index > Fetch the complete documentation index at: https://developer.sumup.com/llms.txt > Use this file to discover all available pages before exploring further. Path: SumUp REST API › Tokens `POST /v0.1/merchants/{merchant_code}/tokens` Creates a short-lived token for the merchant account identified by `merchant_code` and the requested actions. Call this endpoint from your backend using a [supported authentication method](https://developer.sumup.com/api/authentication). You must have access to the merchant account. Before returning the token, check that the user signed in to your application is allowed to accept payments for that account. Pass the returned `access_token` to the SDK. The token expires 15 minutes after creation; use `expires_in` for its remaining lifetime. To continue after it expires, create a new token through this endpoint. **Required permissions:** - `{"relation":"tokens.create","object_type":"merchant","object_id_param":"merchant_code"}` ## Authentication Requires one of the following: - `apiKey`, http, header `Authorization` - `oauth2`, oauth2 ## Path parameters - `merchant_code` (`CreateMerchantToken.path.merchant_code`; string, required) — Unique code of the merchant account that will receive the payments. - example `"MC0X0ABC"` ## Request body _Required._ Actions the merchant token should allow. - `actions` (`CreateMerchantToken.actions`; array, required) — Actions the token allows for this merchant account. - one of `"checkout"`; example `["checkout"]` ## Example request ```json { "actions": [ "checkout" ] } ``` ## Code samples ### CLI ```bash sumup tokens create \ --json \ --merchant-code "MC0X0ABC" \ --action "checkout" ``` ### JavaScript ```typescript import SumUp from "@sumup/sdk"; async function main() { const client = new SumUp({ apiKey: "sup_sk_your_api_key" }); const result = await client.tokens.create( "MC0X0ABC", { "actions": [ "checkout" ] } ); console.log(result); } main().catch(console.error); ``` ### .NET ```csharp using System; using System.Collections.Generic; using System.Threading.Tasks; using SumUp; public static class Program { public static async Task Main() { using var client = new SumUpClient(); var response = await client.Tokens.CreateAsync( "your-merchant-code", new TokensCreateRequest { Actions = new TokensCreateRequestActionsItem[] { TokensCreateRequestActionsItem.Checkout, }, }); Console.WriteLine(response.StatusCode); } } ``` ### Java ```java import com.sumup.sdk.SumUpClient; public final class CreateMerchantTokenSample { public static void main(String[] args) throws Exception { var client = new SumUpClient(); var result = client.tokens().create( "MC0X0ABC", com.sumup.sdk.models.CreateMerchantTokenRequest.builder() .actions(java.util.List.of(com.sumup.sdk.models.CreateMerchantTokenRequestActionsItem.of("checkout"))) .build() ); System.out.println(result); } } ``` ### Python ```python import os import sumup client = sumup.Sumup(api_key=os.environ["SUMUP_API_KEY"]) result = client.tokens.create( "MC0X0ABC", actions=[ "checkout", ], ) print(result) ``` ### PHP ```php [ 'checkout', ], ]; $result = $sumup->tokens()->create( 'MC0X0ABC', $body, ); var_dump($result); ``` ### Go ```go package main import ( "context" "fmt" "github.com/sumup/sumup-go" ) func main() { client := sumup.NewClient() result, err := client.Tokens.Create(context.TODO(), "MC0X0ABC", sumup.TokensCreateParams{ Actions: []sumup.TokensCreateParamsAction{"checkout"}, }) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", result) } ``` ### Rust ```rust use sumup::{Authorization, Client}; #[tokio::main] async fn main() { let client = Client::default() .with_authorization(Authorization::api_key("sup_sk_test_...")); let body = sumup::resources::tokens::CreateRequest::builder() .actions(vec![sumup::resources::tokens::CreateRequestActionsItem::Checkout]) .build(); let response = client .tokens() .create("MERCHANT_CODE", body) .await .expect("create request failed"); println!("{response:#?}"); } ``` ### cURL ```bash curl --request POST \ --url https://api.sumup.com/v0.1/merchants/MC0X0ABC/tokens \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' \ --data ' { "actions": [ "checkout" ] } ' ``` ## Responses ### 200 Merchant token created. Pass its access_token to the SDK. #### Example ```json { "access_token": "MERCHANT_TOKEN", "token_type": "Bearer", "expires_in": 899 } ``` - `access_token` (`CreateMerchantToken.response.200.access_token`; string, required) — Secret token to pass to the SDK. Treat this value as an opaque string; do not parse it or depend on its format. - example `"MERCHANT_TOKEN"` - `token_type` (`CreateMerchantToken.response.200.token_type`; string, required) — Authentication scheme used by the token. Always Bearer. - one of `"Bearer"`; example `"Bearer"` - `expires_in` (`CreateMerchantToken.response.200.expires_in`; integer, required) — Remaining lifetime of the token in seconds when the response is created. Tokens expire 15 minutes after creation. Request a new token when needed. - min 0; example `899` ### 400 The request body is invalid or contains unsupported or duplicate actions. #### Example ```json { "type": "https://developer.sumup.com/problem/bad-request", "title": "Bad Request", "status": 400, "detail": "The request contains an unsupported action." } ``` - `type` (`CreateMerchantToken.response.400.type`; string, required) — A URI reference that identifies the problem type. - format `uri`; example `"https://developer.sumup.com/problem/not-found"` - `title` (`CreateMerchantToken.response.400.title`; string, optional) — A short, human-readable summary of the problem type. - example `"Requested resource couldn't be found."` - `status` (`CreateMerchantToken.response.400.status`; integer, optional) — The HTTP status code generated by the origin server for this occurrence of the problem. - example `404` - `detail` (`CreateMerchantToken.response.400.detail`; string, optional) — A human-readable explanation specific to this occurrence of the problem. - example `"The requested resource doesn't exist or does not belong to you."` - `instance` (`CreateMerchantToken.response.400.instance`; string, optional) — A URI reference that identifies the specific occurrence of the problem. - format `uri`; example `"https://api.sumup.com/v0.1/checkouts/4e425463-3e1b-431d-83fa-1e51c2925e99"` ### 401 Authentication is missing, invalid, or expired. #### Body (application/json) - `type` (`CreateMerchantToken.response.401.type`; string, required) — A URI reference that identifies the problem type. - format `uri`; example `"https://developer.sumup.com/problem/not-found"` - `title` (`CreateMerchantToken.response.401.title`; string, optional) — A short, human-readable summary of the problem type. - example `"Requested resource couldn't be found."` - `status` (`CreateMerchantToken.response.401.status`; integer, optional) — The HTTP status code generated by the origin server for this occurrence of the problem. - example `404` - `detail` (`CreateMerchantToken.response.401.detail`; string, optional) — A human-readable explanation specific to this occurrence of the problem. - example `"The requested resource doesn't exist or does not belong to you."` - `instance` (`CreateMerchantToken.response.401.instance`; string, optional) — A URI reference that identifies the specific occurrence of the problem. - format `uri`; example `"https://api.sumup.com/v0.1/checkouts/4e425463-3e1b-431d-83fa-1e51c2925e99"` ##### Example ```json { "type": "https://developer.sumup.com/problem/unauthorized", "title": "Unauthorized", "status": 401 } ``` #### Body (application/problem+json) - `type` (`CreateMerchantToken.response.401.application-problem-json.type`; string, required) — A URI reference that identifies the problem type. - format `uri`; example `"https://developer.sumup.com/problem/not-found"` - `title` (`CreateMerchantToken.response.401.application-problem-json.title`; string, optional) — A short, human-readable summary of the problem type. - example `"Requested resource couldn't be found."` - `status` (`CreateMerchantToken.response.401.application-problem-json.status`; integer, optional) — The HTTP status code generated by the origin server for this occurrence of the problem. - example `404` - `detail` (`CreateMerchantToken.response.401.application-problem-json.detail`; string, optional) — A human-readable explanation specific to this occurrence of the problem. - example `"The requested resource doesn't exist or does not belong to you."` - `instance` (`CreateMerchantToken.response.401.application-problem-json.instance`; string, optional) — A URI reference that identifies the specific occurrence of the problem. - format `uri`; example `"https://api.sumup.com/v0.1/checkouts/4e425463-3e1b-431d-83fa-1e51c2925e99"` ##### Example ```json { "type": "https://developer.sumup.com/problem/unauthorized", "title": "Unauthorized", "status": 401, "detail": "Token is invalid or expired." } ``` ### 403 The authenticated identity does not have permission to create tokens for this merchant account. #### Example ```json { "type": "https://developer.sumup.com/problem/forbidden", "title": "Forbidden", "status": 403 } ``` - `type` (`CreateMerchantToken.response.403.type`; string, required) — A URI reference that identifies the problem type. - format `uri`; example `"https://developer.sumup.com/problem/not-found"` - `title` (`CreateMerchantToken.response.403.title`; string, optional) — A short, human-readable summary of the problem type. - example `"Requested resource couldn't be found."` - `status` (`CreateMerchantToken.response.403.status`; integer, optional) — The HTTP status code generated by the origin server for this occurrence of the problem. - example `404` - `detail` (`CreateMerchantToken.response.403.detail`; string, optional) — A human-readable explanation specific to this occurrence of the problem. - example `"The requested resource doesn't exist or does not belong to you."` - `instance` (`CreateMerchantToken.response.403.instance`; string, optional) — A URI reference that identifies the specific occurrence of the problem. - format `uri`; example `"https://api.sumup.com/v0.1/checkouts/4e425463-3e1b-431d-83fa-1e51c2925e99"` Source: https://developer.sumup.com/api/tokens/create/index.md