# B2B2C

### API Endpoint

To get access token, you need to hit this API endpoint : 

<table><thead><tr><th>Type</th><th>Value</th></tr></thead><tbody><tr><td>Service Code</td><td>74</td></tr><tr><td>HTTP Method</td><td>POST</td></tr><tr><td>Path</td><td><p></p><pre class="language-json"><code class="lang-json">/authorization/v1/access-token/b2b2c
</code></pre></td></tr></tbody></table>

### API Request Header to get Token

```json
X-SIGNATURE: Pxlv2IIUVdlzdUnbSQqug8YeghmKXJ7Rw5P4xBOOB/tC457UsoZXkO4S1R3oszVcjZDSh38+==
X-TIMESTAMP: 2022-10-07T14:18:39+07:00
X-CLIENT-KEY: MCH-0008-1296507211683
Content-Type: application/json
```

#### Request Header Explanation&#x20;

<table><thead><tr><th>Parameter</th><th>Data Type</th><th>Type</th><th>Description</th></tr></thead><tbody><tr><td>X-Signature</td><td><p></p><pre class="language-json"><code class="lang-json"><strong>string
</strong></code></pre></td><td>Mandatory</td><td>Non-Repudiation &#x26; Integrity checking X-Signature : with asymmetric signature algorithm SHA256withRSA (Private_Key, stringToSign)<br><br><code>stringToSign = client_ID + “|” + X- TIMESTAMP</code></td></tr><tr><td>X-Timestamp</td><td><p></p><pre class="language-json"><code class="lang-json">string
</code></pre></td><td>Mandatory</td><td>Timestamp request on UTC time in ISO8601 UTC+0 format. It means to proceed transaction on UTC+7 (WIB), merchant need to subtract time with 7.<br><br>Ex: to proceed transaction on September 22th 2020 at 08:51:00 WIB, the timestamp should be 2020-09-22T01:51:00Z</td></tr><tr><td>X- Client-Key</td><td><p></p><pre class="language-json"><code class="lang-json">string
</code></pre></td><td>Mandatory</td><td><ol><li>Client’s client_id (PJP Name) (given at completion registration process)</li><li>Merchant to DOKU : client_id merchant</li></ol><p></p><pre class="language-json" data-overflow="wrap"><code class="lang-json">Acquirer to DOKU : client_key given by DOKU
</code></pre><pre class="language-mdx" data-overflow="wrap"><code class="lang-mdx">DOKU to Acquirer : client_key given by acquirer.
</code></pre></td></tr><tr><td>content-type</td><td><p></p><pre class="language-json"><code class="lang-json">string
</code></pre></td><td>Mandatory</td><td>application/json</td></tr></tbody></table>

### API Request Body

Here is the sample of request body to Get Token :&#x20;

```json
{
   "grantType":"authorization_code",
   "authCode":"a6975f82-d00a-4ddc-9633-087fefb6275e",
   "refreshToken":"83a58570-6795-11ec-90d6-0242ac120003",
   "additionalInfo":{
  
   }
}
```

#### Request Body Explanation

<table><thead><tr><th>Parameter</th><th>Data Type</th><th>Type</th><th>Description</th></tr></thead><tbody><tr><td><p></p><pre class="language-json"><code class="lang-json">grantType
</code></pre></td><td>String</td><td>Mandatory</td><td><p>There are 2 options for grantType </p><ol><li>authorization_code </li><li>refresh_token</li></ol><p>Use this for get token B2B2C</p></td></tr><tr><td><pre><code>authCode
</code></pre></td><td>String</td><td>Conditional</td><td>The authorization code received after the User provides the consent. Mandatory if grantType = AUTHORIZATION_CODE</td></tr><tr><td><p></p><pre class="language-mdx"><code class="lang-mdx">refreshToken
</code></pre></td><td>String</td><td>Conditional</td><td>Refresh token to get a new accessToken where the User doesn't need to provide the consent again. Mandatory if grantType = REFRESH_TOKEN. Refresh Token should be less than access token validity and will be manage by the PJP’s application to generate a new access_token</td></tr><tr><td><p></p><pre class="language-json"><code class="lang-json">additionalInfo
</code></pre></td><td>Object</td><td>Optional</td><td>Additional Information</td></tr></tbody></table>

### API Response Body

#### API Response Header

After hitting the above API Request, DOKU will give the response below

| Type        | Value   |
| ----------- | ------- |
| HTTP Status | 200     |
| Result      | Success |

```json
X-CLIENT-KEY: "MCH-0008-1296507211683",
X-TIMESTAMP: "2022-10-07T14:26:50+07:00"
```

<table><thead><tr><th>Parameter</th><th>Data Type</th><th>Type</th><th>Description</th></tr></thead><tbody><tr><td>X-Timestamp</td><td>String</td><td>Mandatory</td><td>Client's current local time in YYYY-MM-DDTHH:mm:ssZ format</td></tr><tr><td>X-Client-Key</td><td>String</td><td>Mandatory</td><td><p>Client’s client_id (PJP Name) (given at completion registration process)</p><p></p><pre class="language-mdx"><code class="lang-mdx">Merchant to DOKU : client_id merchant.
</code></pre><pre class="language-mdx"><code class="lang-mdx">DOKU to Acquirer : client_key given by acquirer.
</code></pre><pre class="language-mdx"><code class="lang-mdx">Acquirer to DOKU : client_key given by DOKU
</code></pre></td></tr></tbody></table>

#### API Response Body

```json
{
   "responseCode":"2007400",
   "responseMessage":"Successful",
   "accessToken":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJqdGkiOiIyMTFlZThiMi1hN2FlLTRhZGUtYmJlYS1mNzI3MDk3ZmQ0NmEiLCJjbGllbnRJZCI6IjZhZTk1N2M0LTI4NjMtNDcxMy1hY2NlLWJhMTJkZTYzNmNmYyIsIm5iZiI6MTYxMTQ2ODk3OCwiZXhwIjoxNjExNDY5ODc4LCJpYXQiOjE2MTE0Njg5Nzh9.KM7yz9GvuUaDR1bXwei4iO0h4e3g4o1Hct5Ie9VoBdo",
   "tokenType":"Bearer",
   "accessTokenExpiryTime":"2020-01-01T00:00:00+07:00",
   "refreshToken":"57d21fe3-ba9c-4f2d-9fde-eae669bbf80d",
   "refreshTokenExpiryTime":"2020-01-01T00:00:00+07:00",
   "additionalInfo":{
   }
}
```

<table><thead><tr><th>Parameter</th><th>Data Type</th><th>Type</th><th>Description</th></tr></thead><tbody><tr><td><p></p><pre class="language-json"><code class="lang-json">responseCode
</code></pre></td><td>String (6)</td><td>Mandatory</td><td><p>Response Code : </p><pre class="language-json"><code class="lang-json">HTTP status code + service code + case code
</code></pre></td></tr><tr><td><p></p><pre class="language-json"><code class="lang-json">responseMessage
</code></pre></td><td>String</td><td>Mandatory</td><td>Response Description</td></tr><tr><td><p></p><pre class="language-json"><code class="lang-json">accessToken
</code></pre></td><td>String (2048)</td><td>Mandatory</td><td>A string representing an authorization issued to the client that used to access protected resources.</td></tr><tr><td><p></p><pre class="language-json"><code class="lang-json">tokenType
</code></pre></td><td>String</td><td>Mandatory</td><td>The access token type provides the client with the information required to successfully utilize the access token to make a protected resource request (along with type-specific attributes).<br><br>Token Type Value: “Bearer”: includes the access token.<br><br>string in the request “Mac”: issuing a Message.<br><br>Authentication Code (MAC) key together with the access token that is used to sign certain components of the HTTP requests. Reference: OAuth2.0 RFC 6749 &#x26; 6750</td></tr><tr><td><p></p><pre class="language-json"><code class="lang-json">accessTokenExpiryTime
</code></pre></td><td>String</td><td>Mandatory</td><td>Session expiry in seconds : 900 (15 minute )</td></tr><tr><td><p></p><pre class="language-json"><code class="lang-json">refreshToken
</code></pre></td><td>String</td><td>Mandatory</td><td>A random string that can be used by specific client to get a refreshed accessToken to prolong the access to the User's resources.</td></tr><tr><td><p></p><pre class="language-json"><code class="lang-json">refreshTokenExpiryTime
</code></pre></td><td>String</td><td>Mandatory</td><td>A random string that can be used by specific client to get a refreshed accessToken to prolong the access to the User's resources.</td></tr><tr><td><p></p><pre class="language-json"><code class="lang-json">additionalInfo
</code></pre></td><td>String</td><td>Optional</td><td>Additional Information</td></tr></tbody></table>

#### Error Response

For several error cases, the response appear would be like below :&#x20;

{% tabs %}
{% tab title="X-Timestamp format no valid" %}

```json
"responseCode": "4017400",
"responseMessage": "Unauthorized. Unknown Client"
```

{% endtab %}

{% tab title="Signature not valid" %}

```json
"responseCode": "4017400",
"responseMessage": "Unauthorized. Signature"
```

{% endtab %}

{% tab title="X-Client Key not authorized" %}

````json
"responseCode": "4017400",
    "responseMessage": "Unauthorized. Unknown Client"
```
````

{% endtab %}
{% endtabs %}


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://developers.doku.com/accept-payments/direct-api/snap/integration-guide/get-token-api/b2b2c.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.