---
title: "Client side tokens"
description: "Guide to using client-side tokens for accessing APIs without API credentials."
category: "Integrations"
path: "/guides/online-payments/integrations/client-side-tokens.md"
---

# **Client side tokens**

**Client-side tokens** are an essential part of API security from Surfboard that allows client applications (like web browsers or mobile apps) to authenticate directly with the Surfboard API without using sensitive **`API-KEY`** or **`API-SECRET`**. This significantly enhances the security of your integrations.

With the client-side token, you can perform requests related to:

- [**Orders**](api/orders)
- [**Payments**](api/payments)
- [**Transactions**](api/transactions)
- [**Tips**](api/tips)
- [**Reporting**](api/reporting)
- [**Branding**](api/branding)
- [**Receipts**](api/receipts)

{% callout type="note" label="Note" %}
Client-side tokens are designed for customer-facing or operational tasks. You **cannot** use them to perform administrative tasks (e.g., creating merchants, managing stores, or other backend administrative functions). These tasks still require your full API credentials.
{% /callout %}

## Prerequisites

- **API Credentials** and **`merchantId`** to generate tokens.

## Create tokens

1. Tokens are generated by sending a **`POST`** request to the [**Client Auth Token API**](/api/auth), with required parameters

    - **`providerId`** - Your unique provider identifier that authenticates your system as the source requesting the token.
    - **`providerCertificate`** - The security certificate associated with your provider identity.
    - **`externalUserId`** - A unique string identifier for the specific user (e.g., a customer ID from your system) for whom the token is being created.

{% callout type="note" label="Note" %}
 To get **`providerId`** and **`providerCertificate`**, kindly contact [integrations@surfboard.se](mailto:integrations@surfboard.se) or via our Slack channel.
 {% /callout %}

2. This API returns a response of **`token`** and **`validUntil`** , the generated token must be included in future requests to Surfboard.

>Every token has an expiration period, after which a new token must be fetched.

## Using client side tokens

To authorize your API requests using a client-side token, you must include the generated token in the **`authorization`** header of your API call.

The token should be passed as a **Bearer Token**, following this format:

`Authorization: Bearer <YOUR_TOKEN>`

Here is a simple example using client side token with curl:

Initiate a payment with Client Side Tokens

```bash

curl -d '{
          "orderId": "834572bb30e7903b0b",
          "paymentMethod": "CARD"
         }' \
     -H 'Content-Type: application/json' \
     -H 'Authorization: Bearer <YOUR_TOKEN>'
     YOUR_API_URL/payments
```

>Replace `<YOUR_TOKEN>` with the actual token you received from the Client Auth Token API.

{% docfooter relatedLinks="[{ title: 'APIs and Environments', url: '/guides/online-payments/integrations/apis-and-environments' },{ title: 'API Architecture', url: '/guides/online-payments/integrations/api-architecture' }]" /%}