How to Request Access Token

In order to make transactions with Dipay API products, business clients need to be authenticated first and get an Access Token. After granted access, the access token can be used to access other API. To get Access token, you need to use Asymmetric Signature. You need to input your Public Key in your Dashboard. Go to Settings >> Developer Option >> SNAP Credential tab.

‍

Prerequisites

Before requesting Access Token, you need to:

Register IP Address
Have our API products Activated.
Register Public Key: RSA 1024 Public Key

‍

Steps to Get your Credential

‍

‍

Login to your Dashboard and go to Settings >> Developer Options >> SNAP Credential. Ensure to log in as Superadmin or Developer in order to be able to access this menu.
In this menu, you will find your Client Key, Client Secret (Secret Key), and field to input your Public Key.

‍

URL to Request for Access Token

POST https://partner-b2x.dipay.id/api/bi-snap/v2.1/access-token/b2b

‍

Header Parameters

Parameter	Data Type	Mandatory	Length	Description
Content-Type	String	M		String represents indicate the media type of the resource, filled with: application/json
X-TIMESTAMP	String (ISO8601)	M	25	Client's current local time in yyyy-MM-ddTHH:mm:ss+07:00 format (e.g 2020-12-21T17:48:41+07:00)
X-CLIENT-KEY	String	M	36	Client’s client_key generated by Dipay
X-SIGNATURE	String	M	256	Represents signature of a request. X-SIGNATURE value will be described below: SHA256withRSA(private_key, stringToSign) with formula stringToSign = CLIENT_KEY + "\|" + X-TIMESTAMP

‍

Request Body

Parameter	Data Type	Mandatory	Length	Description
grantType	String	M	64	Fill in with: “client_credentials”

‍

Response Body

Parameter	Data Type	Mandatory	Length	Description
responseCode	String	O	7	Response code = HTTP status code + service code + case code
responseMessage	String	O	150	Response description
accessToken	String	M	2048	Client's access token in Bearer
tokenType	String	M		Token type: "Bearer"
expiresIn	String	M	3	Session expiration time. accessToken will expire in 900 secs (15 mins)

‍

Response Codes

‍

Category	HTTP Code	Service Code	Case Code	Response Message	Description
Success	200	73	00	Successful	Authentication is successfull
System	400	73	00	Bad Request. {Reason}	General request failed error, including message parsing failed
Message	400	73	02	Invalid Mandatory Field {Field Name}	Missing or invalid format on mandatory field
Message	401	73	00	Unauthorized. {Reason}	General unauthorized response (ex: invalid client key)
System	500	73	00	General Error
System	500	73	01	Internal Server Error	Unknown Internal Server Failure, Please retry the process again

{
   "grantType":"client_credentials"
}
curl -X POST "https://partner-b2x.dipay.id/api/bi-snap/v1/access-token/b2b" 
  -H "Content-Type: application/json" 
  -H "X-TIMESTAMP: 2026-08-11T10:10:06+07:00" 
  -H "X-CLIENT-KEY: YOUR_CLIENT_KEY" 
  -H "X-SIGNATURE: YOUR_SIGNATURE"
Request Samples

    
    
  
Sample Response Body
{
   "responseCode":"2007300",
   "responseMessage":"Successful",
   "accessToken":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJqdGkiOiJiZjFmM2Q3ZS1kOTA3LTRkOWItODJlNC02Y2IxZGYxOTBlOWUiLCJjbGllbnRJZCI6IjZhZTk1N2M0LTI4NjMtNDcxMy1hY2NlLWJhMTJkZTYzNmNmYyIsIm5iZiI6MTYxMTQ2ODg1NiwiZXhwIjoxNjExNDY5NzU2LCJpYXQiOjE2MTE0Njg4NTZ9.-7HRhcyEh4y0qsG2H3DRdu0AeYv3MEJHfWRKhRBYcNU",
   "tokenType":"Bearer",
   "expiresIn":"900"
}
Response Samples

SNAP Digital Signature

Asymmetric Signature

‍

You will need to generate a pair of public and private keys for the authentication process. The public key will be shared to the provider so that the provider will be able to verify the signature for the authentication process. The public key will need to follow standards such as PKCS#1 format.

‍

Symmetric Signature

Symmetric signature use Client ID and Client Secret that is provided by Dipay.

‍

Setting up credential needed for authentication (Input public key and obtaining Client Secret and Client ID) can be done in your Dashboard. Go to Setting >> Developer Options >> SNAP Credential tab.

Request Samples

Response Samples

Accessing API with Digital Signature

In order to be able to access our API, you need to input these information in the header.

‍

Header	Description
Content-Type	Request media type such as “application/json”
X-TIMESTAMP	Timestamp in ISO 8601 format.
X-SIGNATURE	Symmetric signature generated using HMAC-SHA512. Compose this string string to sign: HTTPMethod +”:“+ EndpointUrl +":“+ accessToken + ”:” + Lowercase(HexEncode(SHA-256(minify(RequestBody)))) + ":“ + “”
Authorization	Bearer Token that will be used to authorize the client for API requests.
ORIGIN	Request Origin
X-EXTERNAL-ID	Reference number that should be unique on the same day.
CHANNEL-ID	DIPAY channel id ("DPAPI")

X-PARTNER-ID	Partner’s Client ID/Client Key that will be provided by the issuer. Used in transactional API.

Request Samples

Response Samples