Get a token — getToken

Obtains the ANONY-TOKEN required by all subsequent endpoints. This endpoint's request body is neither encrypted nor signed — authentication is md5 only.

This is the first step of the full integration flow: exchange your APP-ID + secret for a token, then pass that token when calling the business endpoints. See Keys & Credentials for how to obtain and store your credentials.

Endpoint

POST https://api.anonypay.io/api/merchant/getToken

Request headers

Header	Description
ANONY-APP-ID	Merchant ID
Authorization	auth + md5(APP-ID + "&" + secret)

In other words: join the merchant ID and the secret with &, take the MD5 of the result, and prepend auth (note the single space after auth).

Request body

May be empty.

Response fields (after decryption)

Field	Type	Description
token	string	The ANONY-TOKEN to use on subsequent requests

The response is not a plaintext token

Like every other endpoint, the getToken response is an encrypted + signed envelope ({ "code": 10000, "data": "<base64 ciphertext>", "message": "success" }, with ANONY-TIMESTAMP / ANONY-NONCE / ANONY-SIGN response headers) — not a plaintext token. Always verify the signature and decrypt with the SDK before reading the token field. See the protocol specification for the envelope verification and decryption steps.

Token lifetime and renewal policy (implementation detail)

Tokens use a sliding 8-hour expiry with an absolute 24-hour cap: every successful call extends the expiry, but a token always expires at most 24 hours after it was issued. When you receive a tokenExpired error, simply call getToken again for a fresh token and retry the original request once — no other handling is needed.

Example request

curl -X POST 'https://api.anonypay.io/api/merchant/getToken' \
  -H 'ANONY-APP-ID: <your merchant ID>' \
  -H 'Authorization: auth <md5(APP-ID&secret)>'

Raw response (data is ciphertext — verify the signature, then decrypt):

{ "code": 10000, "data": "<base64 ciphertext>", "message": "success" }

The business JSON after decrypting data:

{ "token": "..." }

SDK usage

PHP / Node ship a ready-to-use getToken() (HTTP call included). Python / Go / Java provide authHeader() (which computes auth + md5(APP-ID & secret)); you make the HTTP call with the library of your choice and handle the response with verifyResponse / verify + decrypt.

PHP

require 'AnonyV2Client.php';
$client = new AnonyV2Client($appId, $serverPublicKeyB64, $merchantPrivateKeyB64);
$token  = $client->getToken($secret);  // md5 auth + signature verification + decryption, token extracted automatically

Python

from anony_v2 import AnonyV2Client, auth_header
import requests

c = AnonyV2Client(app_id, server_pub_b64, merchant_priv_b64)

# Request is not encrypted (md5 auth only); the response still needs signature verification + decryption
tr = requests.post(c.base_url + "getToken",
                   headers={"ANONY-APP-ID": str(app_id), "Authorization": auth_header(app_id, secret)})
tb = tr.json()
token = c.verify_response(tb["data"], tr.headers["ANONY-TIMESTAMP"],
                          tr.headers["ANONY-NONCE"], tr.headers["ANONY-SIGN"])["token"]

Node.js

const { AnonyV2Client } = require('./anony_v2');
const c = new AnonyV2Client(appId, serverPubB64, merchantPrivB64);
const token = await c.getToken(secret); // Node >=18: md5 auth + signature verification + decryption, token extracted automatically

Go / Java: when fetching a token, compute the Authorization header with AuthHeader / authHeader, POST to getToken, then use verify + decrypt to unwrap the response envelope and extract token. See the Go SDK and Java SDK for details.

Common errors

Error	Description
authFailed	Authentication failed: check the Authorization header format (auth prefix followed by a space) and the md5 input (the separator between APP-ID and the secret is &)
tokenExpired	Returned by subsequent business endpoints: the token has expired — call getToken again and retry the request once

See Errors & Troubleshooting for the full list of error codes.

Next steps

• Once you have a token, call the selfcheck endpoint first to validate your entire encryption / signing pipeline.
• Then integrate the business endpoints, starting with createAddress.