> ## Documentation Index
> Fetch the complete documentation index at: https://api.tandapay.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Generate bearer token

> Exchange your keys for a one-hour bearer token.

> [!WARNING]
>
> Call this endpoint from your server only. Anyone holding your API key can move money on your account.

See [Authentication](https://api.tandapay.io/guides/authentication.md) for a token cache that refreshes before expiry.


## OpenAPI

````yaml POST /api/b2b/auth/generate-bearer-token
openapi: 3.1.0
info:
  title: Tanda API
  version: 1.0.0
  description: >-
    Collect and send KES payments in Kenya through M-PESA, Airtel Money and bank
    transfer.
servers:
  - url: https://api.tandapay.io
    description: Sandbox and production (your keys decide which)
security:
  - bearerAuth: []
tags:
  - name: Authentication
  - name: Account
  - name: Checkout
  - name: Collections
  - name: Payouts
  - name: Beneficiaries
  - name: Transactions
  - name: Reference data
  - name: Webhooks
paths:
  /api/b2b/auth/generate-bearer-token:
    post:
      tags:
        - Authentication
      summary: Generate bearer token
      description: >-
        Exchanges your public key and secret API key for a bearer token. Send
        the token as `Authorization: Bearer <token>` on every other request.
        Tokens are valid for one hour; refresh before `expiresAt`.


        Call this from your server only. Never expose your API key in a browser
        or mobile app.
      operationId: generate-bearer-token
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                publicKey:
                  type: string
                  description: >-
                    Your public key from **Developers → API keys** in the
                    dashboard.
                  example: pk_live_xxxxxxxxxxxxxxxx
              required:
                - publicKey
            example:
              publicKey: pk_live_xxxxxxxxxxxxxxxx
      responses:
        '200':
          description: Token issued.
          content:
            application/json:
              schema:
                type: object
                properties:
                  success:
                    type: boolean
                  token:
                    type: string
                    description: Bearer token (JWT).
                  expiresAt:
                    type: integer
                    description: Expiry as a Unix timestamp in seconds.
              example:
                success: true
                token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
                expiresAt: 1767225600
        '401':
          description: The API key and public key don't match, or the key has been revoked.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
              example:
                success: false
                message: Unauthorized
      security:
        - apiKeyAuth: []
components:
  schemas:
    Error:
      type: object
      properties:
        success:
          type: boolean
          example: false
        message:
          type: string
          description: Human-readable; may change.
        errorCode:
          type: string
          description: Stable code to branch on.
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: Token from Generate bearer token.
    apiKeyAuth:
      type: apiKey
      in: header
      name: api-key
      description: Your secret API key. Used only to generate a bearer token.

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.