:::caution note
In the Sandbox environment, you must authenticate using Sandbox API credentials only. Authentication tokens generated in Sandbox are valid only within this environment and must not be used in Production. Sandbox tokens simulate real authorization flows but do not provide access to live financial operations.
:::

## What do I need to use the payment API?
To use the payment API, [HTTP Basic Auth](https://en.wikipedia.org/wiki/Basic_access_authentication) is required. You will need to know the unique credentials of your business to enter the system. These credentials consist of two parameters, `client_id`, and `client_secret`, used as the username and password for business authentication.

## How to obtain the credentials for entering the business system?
Upon registering a company as a business in the banking system and providing all the necessary data, the system provides the credentials `client_id` and `client_secret` necessary to enter the system. These credentials are unique identifiers of the business. It is impermissible to disclose or transfer the `client_secret` parameter to another person. Doing so significantly increases the probability of a security breach. The business cannot change the `client_secret` parameter.

## Method description
This method allows businesses to undergo the authentication process. Upon calling the API, the online payment server returns the `Bearer Token`, which is the necessary authentication parameter for calling all further methods.

### Header parameters

- `Content-Type` — application/x-www-form-urlencoded, required

- `Authorization` — Basic <base64>, required

  'Basic ' + '<client_id>:<secret_key>' encoded in the Base64 format is transmitted as a value (e.g., 'Basic ODI4Mjo3Njk3MDY0OTlmMDcwOWUyMzQ4NDU4NjNmOThiMjMxNA=='), where <client_id> and <secret_key> are the credentials necessary to enter the system, transmitted by the bank to the business.

### Body parameters

- `grant_type` — client_credentials, required

  The fixed text `client_credentials` is transmitted as the value.

**CURL**

```bash
curl -X POST 'https://oauth2-sandbox.bog.ge/auth/realms/bog/protocol/openid-connect/token' \
-u {client_id}:{client_secret} \
-H 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'grant_type=client_credentials'
```

### Response

- `access_token` — string

  The Token is returned by the authorization server.

- `token_type` — string

  The type of Token (fixed value – `Bearer` – is returned).

- `expires_in` — number

  The number of seconds while the Token is active.

**RESPONSE**

```json
{
  "access_token": "<JWT>",
  "token_type": "Bearer",
  "expires_in": 1634719923245
}
```