> For the complete documentation index, see [llms.txt](https://docs.ecommerce.seb.ee/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.ecommerce.seb.ee/integration/merchant-api/api-security.md). # API Security ### Authentication The Merchant API uses the **OAuth 2.0 Client Credentials** flow. Each shop has a **Client ID** and **Client Secret**. Exchange them for an access token. Include the token in every API request’s `Authorization` header: ``` Authorization: Bearer ``` Separate credentials are issued for the **Sandbox** and **Live** environments. Access tokens are environment-specific and can only be used with the API endpoints of the environment to which they belong. Client credentials are available in the **Merchant Portal** under **Settings → Shop Settings → Technical Information**. {% hint style="warning" %} Keep your Client ID, Client Secret and the retrieved access tokens secure, never expose them in client-side applications, mobile apps, or browser code. Authentication and API requests should be performed from a secure backend environment. {% endhint %} #### **Obtaining an Access Token** To obtain an access token, send a `POST` request to the authentication endpoint: . The request must contain the `grant_type=client_credentials`, `client_id` and `client_secret` parameters, for example: ```http POST https://api.ecommerce.sebgroup.com/auth/realms/participants-seb/protocol/openid-connect/token Content-Type: application/x-www-form-urlencoded grant_type=client_credentials &client_id= &client_secret= ``` A successful request returns an access token together with its expiration time in seconds: 
{
 "access_token": "...",
 "expires_in": 7200,
 "token_type": "Bearer"
}
#### **Token Renewal** Access tokens have a limited lifetime and must be renewed upon expiration. To obtain a new access token, repeat the token request using the same Client ID and Client Secret. Applications should: * Cache and reuse the access token until it expires. * Request a new access token when the current token expires or is close to expiration. * Handle authentication failures (HTTP 401 Unauthorized responses) by obtaining a new access token and retrying the request. ### Encryption Communication with the Merchant API uses **Transport Layer Security (TLS)**. TLS encrypts data between your systems and the SEB Ecommerce Payment Gateway in transit. For API operations containing **sensitive payment data**, an additional layer of **end-to-end encryption** is applied on top of TLS. Sensitive data is encrypted using the SEB Ecommerce Payment Gateway's public key before transmission and can only be decrypted by the corresponding private key held by the gateway backend. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.ecommerce.seb.ee/integration/merchant-api/api-security.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.