[block:html] { "html": "\n" } [/block] # Overview To secure communication between your app and the merchant, you need an OAuth token, also known as the `access_token`. The `access_token` is required to: - Complete the Ecommerce API authorization flow that grants your app the necessary permissions to access the merchant's data. - Generate an Ecommerce API key (apiAccessKey), also known as the PAKMS key, using the Ecommerce - PAKMS Service API. This key identifies the merchant tokenizing customers' cards and can be used to tokenize multiple cards for that merchant. # Get started [block:html] { "html": "\n \n \n

Use the v2/OAuth flow

Generate expiring token (`access_token` and `refresh_token` pair).

\n \n

\n\n

Use the refresh token

Generate a new access_token and refresh_token pair before the current one expires.

\n \n

\n\n

Migrate to the v2/OAuth flow

Migrate apps using the legacy OAuth flow to use an expiring authentication token that includes an access_token and refresh_token pair.

\n \n

\n \n" } [/block] # Clover OAuth flows—Legacy OAuth and v2/OAuth All Ecommerce API endpoints require an OAuth-generated expiring token with specific permissions. Clover apps must use expiring OAuth tokens generated through the v2/OAuth flow. Note the following: - **Recent applications**—Apps created after October 2023 use the v2/OAuth flow to [generate expiring tokens](https://docs.clover.com/dev/docs/generate-oauth-expiring-access-and-refresh-token) (`access_token` and `refresh_token` pair). - **Legacy applications**—Apps created before October 2023 used the legacy OAuth flow to generate an `auth_token` and must [migrate to using expiring tokens](https://docs.clover.com/docs/legacy-token-migration-flow#) (`access_token` and `refresh_token` pair) for uninterrupted app functionality. For information on the legacy OAuth flow, see Generate OAuth token with the legacy OAuth flow ![](https://files.readme.io/2504750-image.png). *** *** # Watch video: Clover OAuth expiring tokens [block:html] { "html": "

\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n

Watch	Learn
\n \n \n \n \n \n	\n In this video, learn: \n \n What are expiring tokens. \n How to generate access and refresh tokens. \n How to migrate an existing app to use expiring tokens. \n How to start the OAuth flow from the Merchant Dashboard left navigation app link. \n \n View or download:\n\n Clover expiring tokens slides \n

Watch

Learn

\n \n

In this video, learn:

What are expiring tokens.
How to generate access and refresh tokens.
How to migrate an existing app to use expiring tokens.
How to start the OAuth flow from the Merchant Dashboard left navigation app link.

View or download:\n\n Clover expiring tokens slides

\n\n\n" } [/block] *** *** # Related topics - Blog: Expiring OAuth Tokens: Securing Clover Merchant Data - Blog: Fiddling Through Digital Keys: Clover Auth Tokens and Ecommerce Keys