REST API Access Token

This guide describes how to obtain an access token required to make an i'mport REST API request.

To gain access to private resources, such as payment information, you must obtain an access token and include it in the i'mport REST API request.

Get Access Token

Request access token from the server-side

If you request for access token from the client-side, the REST API key and REST API Secret are exposed to public creating a potential security vulnerability. Therefore, you must request for acccess token from the server-side.
1Request access token
To request for an access token, call the REST API (POST https://api.iamport.kr/users/getToken with the REST API Key and REST API Secret obtained from the Admin Console.
  curl -H "Content-Type: application/json" POST -d '{"imp_key": "REST API Key", "imp_secret":"REST API Secret"}' https://api.iamport.kr/users/getToken
2Get access token
Get the acces token received in the response for the request.
  {
    "code": 0,
    "message": null,
    "response":{
      "access_token": "a9ace025c90c0da2161075da6ddd3492a2fca776", // access token
      "now": 1512446940, // i'mport REST API server's timestamp
      "expired_at": 1512448740, // token's expiration (UNIX timestamp, KST)
    },
  }

Standard NTP server

The i'mport REST API server synchronizes with the standard time using Google Public NTP.

Using Access Token

You can use the access token to make an i'mport REST API call.

Since i'mport REST APIs use the Bearer authentication method, the HTTP request header includes the access token in the following format:

Authorization: Bearer a9ace025c90c0da2161075da6ddd3492a2fca776

Call the REST API to get the payment information by including the access token in the request header as follows:
  curl -H "Content-Type: application/json" -H "Authorization: Bearer a9ace025c90c0da2161075da6ddd3492a2fca776" https://api.iamport.kr/payments/imp_448280090638

Reissuing and Reusing Access Token

The expiration of the access token is 30 minutes from the time of issuance. A token cannot be used after its expiration. An API call request with an expired token returns a 401 Unauthorized response.

The following is the policy for reissuance and reuse of access tokens.
  • Reissuance (after expiration): A new access token is issued. (Expiration: 30 minutes after issuance)
  • Reuse (before expiration): Existing access token is reused. (Expiration: same as before, but extended by 5 minutes if requested within 1 minute from the original expiration)

5 minute extension of expiration

The reuse and 5 minute lifetime extension of access token are provided for the following situations:
  • Multiple web servers of one merchant are competing to call the REST API (/users/getToken) at the same time.
  • Multiple web servers of one merchant are not synchronized in time.