# Generate Access Token

Create access token by using [**`HMAC-SHA256`**](https://en.wikipedia.org/wiki/HMAC)

An access token can be generated by combining the api\_key and timestamp string with the provided api\_secret.

| Attribute        | Description                                        |
| ---------------- | -------------------------------------------------- |
| **`api_key`**    | Get it from your PAVE Developer dashboard          |
| **`api_secret`** | Get it from your PAVE Developer dashboard          |
| **`timestamp`**  | UTC Datetime string, example: 2021-05-30T12:49:19Z |

### Examples in Different Languages:

{% tabs %}
{% tab title="PHP" %}

```php
$token = hash_hmac('sha256', '<username>:<api_key>@<timestamp>', '<api_secret');
// https://www.php.net/manual/en/function.hash-hmac.php
```

{% endtab %}

{% tab title="Javascript" %}

```javascript
const crypto = require('crypto');

const apiKey = 'your_api_key';
const apiSecret = 'your_api_secret';
const username = 'your_username';
const timestamp = (new Date()).toJSON(); 

const message = `${username}:${apiKey}@${timestamp}`;
const accessToken = crypto.createHmac('sha256', apiSecret).update(message).digest('hex');
```

{% endtab %}

{% tab title="Python" %}

```python
import hashlib
import hmac
from datetime import datetime, timezone

api_key = 'your_api_key'
api_secret = 'your_api_secret'
username = 'your_username'

timestamp = datetime.now(timezone.utc).isoformat()

message = f'{username}:{api_key}@{timestamp}'
access_token = hmac.new(api_secret.encode('utf-8'), msg=message.encode('utf-8'), digestmod=hashlib.sha256).hexdigest()
```

{% endtab %}

{% tab title="Golang" %}

```go
package main

import (
	"crypto/hmac"
	"crypto/sha256"
	"encoding/hex"
	"fmt"
	"time"
)

func main() {
	apiKey := "your_api_key"
	apiSecret := "your_api_secret"
	username := "your_username"
	timestamp := time.Now().Format(time.RFC3339)

	message := fmt.Sprintf("%s:%s@%d", username, apiKey, timestamp)
	hmac := hmac.New(sha256.New, []byte(apiSecret))
	hmac.Write([]byte(message))
	access_token := hex.EncodeToString(hmac.Sum(nil))

	fmt.Println(signature) // prints the HMAC-SHA256 signature
}
```

{% endtab %}

{% tab title="Swift" %}

```swift
import CommonCrypto
import Foundation

func hmacSha256(message: String, key: String) -> String {
    let messageData = message.data(using: .utf8)!
    let keyData = key.data(using: .utf8)!
    var hmacData = Data(count: Int(CC_SHA256_DIGEST_LENGTH))

    hmacData.withUnsafeMutableBytes { hmacPtr in
        CCHmac(CCHmacAlgorithm(kCCHmacAlgSHA256), (keyData as NSData).bytes, keyData.count, (messageData as NSData).bytes, messageData.count, hmacPtr)
    }

    return hmacData.map { String(format: "%02hhx", $0) }.joined()
}

let apiKey = "your_api_key"
let apiSecret = "your_api_secret"
let username = "your_username"

let dateFormatter = ISO8601DateFormatter()
dateFormatter.timeZone = TimeZone(secondsFromGMT: 0)
let timestamp = dateFormatter.string(from: Date())

let message = "\(username):\(apiKey)@\(timestamp)"
let accessToken = hmacSha256(message: message, key: apiSecret)
```

{% endtab %}

{% tab title="Kotlin" %}

```kotlin
import java.nio.charset.StandardCharsets
import java.security.Key
import java.security.MessageDigest
import javax.crypto.Mac
import javax.crypto.spec.SecretKeySpec
import java.time.LocalDateTime
import java.time.OffsetDateTime
import java.time.ZoneOffset
import java.time.format.DateTimeFormatter

fun main() {
    val apiKey = "your_api_key"
    val apiSecret = "your_api_secret"
    val username = "your_username"
    
    val utcDateTime = LocalDateTime.now(ZoneOffset.UTC)
    val offsetDateTime = OffsetDateTime.of(utcDateTime, ZoneOffset.UTC)
    val formatter = DateTimeFormatter.ofPattern("yyyy-MM-dd'T'HH:mm:ssXXX")
    val timestamp = offsetDateTime.format(formatter)

    val message = "$username:$apiKey@$timestamp"
    val accessToken = hmacSha256(message, apiSecret)    
}

fun hmacSha256(message: String, key: String): String {
    val secretKey = SecretKeySpec(key.toByteArray(StandardCharsets.UTF_8), "HmacSHA256")
    val mac = Mac.getInstance("HmacSHA256")
    mac.init(secretKey)
    val hmac = mac.doFinal(message.toByteArray(StandardCharsets.UTF_8))
    return bytesToHex(hmac)
}

fun bytesToHex(bytes: ByteArray): String {
    return bytes.joinToString("") { "%02x".format(it) }
}
```

{% endtab %}
{% endtabs %}

{% hint style="info" %}
To generate the correct token, please make sure the combination string you are using with the 1) api\_key, 2) timestamp and 3) api\_secret are arranged in this order.
{% endhint %}

{% hint style="info" %}
To generate the correct token, please ensure your timestamp is using UTC Datetime. And use the matching timestamp to the one included in your header when generating your token.
{% endhint %}

{% hint style="info" %}
Replace        \<username>&#x20;

with the primary account name that your representative initially provided. If you have an Enterprise account, use that account name, not one of the branch account.  Do not set \<username) as one of the user names you created in your dashboard.
{% endhint %}


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.paveapi.com/integrations/developer-docs/authentication/generate-access-token.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.