> ## Documentation Index > Fetch the complete documentation index at: https://docs.gnosispay.com/llms.txt > Use this file to discover all available pages before exploring further. # Generate a new ephemeral token > Generates a new ephemeral token for secure PCI operations. Ephemeral tokens are single-use tokens with a short lifespan (60 seconds) that are used to authorize sensitive PCI operations like retrieving card details or setting a PIN. This endpoint requires mTLS (Mutual TLS) authentication using a valid client certificate. The client certificate must be issued by a trusted Certificate Authority and contain valid partner identifier in its subject. ## mTLS Requirements - Certificate must be issued by a trusted Certificate Authority - Certificate must contain a valid partner app ID in the CN (Common Name) field - Certificate must be valid and not expired - Certificate must be presented during the TLS handshake Example certificate subject format: ``` CN=gp_f1a9b6c741c94510bb3b27f2e8379e29,C=US ``` ## Testing the Endpoint Due to browser limitations, this endpoint cannot be tested directly in Swagger UI. Use one of the following methods: ### Using cURL ```bash curl -X POST --cert client.crt --key client.key https://${{AUTHENTICATED_PSE_API_URL}}/api/v1/ephemeral-token ``` **Certificate and Key Format Requirements:** - **Certificate file (`.crt/.pem`)** and **Private key file (`.key/.pem`)**: both must be in PEM format Example certificate format: ``` -----BEGIN CERTIFICATE----- MIIFazCCA1OgAwIBAgIRAIIQz7DSQONZRGPgu2oCiwYwDQYJKoZIhvcNAQELBQAw ... (base64 encoded certificate data) ... -----END CERTIFICATE----- ``` Example private key format: ``` -----BEGIN PRIVATE KEY----- MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQC7VJTUt9Us8cKB ... (base64 encoded private key data) ... -----END PRIVATE KEY----- ``` **Important Notes:** - Ensure certificate and key files have proper line endings - Certificate and key files should be readable by the client application - The private key must correspond to the certificate being used - Certificate must be valid and not expired ### Using Postman 1. Go to Settings > Certificates 2. Add your client certificate and private key 3. Make sure to select the certificate for the correct host ### Using Node.js ```javascript import https from "https"; const httpsAgent = new https.Agent({ cert: CERT, key: KEY, rejectUnauthorized: true, }); const req = https.request( { hostname: "api-pse.gnosispay.com", path: "/api/v1/ephemeral-token", method: "POST", headers: { "Content-Type": "application/json", "User-Agent": "User-Client/1.0.0", }, agent: httpsAgent, }, (res) => { let data = ""; res.on("data", (chunk) => { data += chunk; }); res.on("end", () => { console.log("Status:", res.statusCode); try { const parsedData = JSON.parse(data); console.log("Response:", parsedData); } catch { console.log("Raw response:", data); } }); }, ); req.on("error", (error) => { console.error("Request error:", error); }); req.end(); ``` ## OpenAPI ````yaml https://api-pse-public.gnosispay.com/api-docs/spec.json post /api/v1/ephemeral-token openapi: 3.0.0 info: title: Gnosis Pay Partner Secure Elements (PSE) API version: 1.0.0 description: OpenAPI documentation for the Gnosis Pay Partner Secure Elements (PSE) API. servers: - url: https://api-pse.gnosispay.com description: PSE API security: - mtls: [] tags: [] paths: /api/v1/ephemeral-token: post: tags: - Endpoints summary: Generate a new ephemeral token description: > Generates a new ephemeral token for secure PCI operations. Ephemeral tokens are single-use tokens with a short lifespan (60 seconds) that are used to authorize sensitive PCI operations like retrieving card details or setting a PIN. This endpoint requires mTLS (Mutual TLS) authentication using a valid client certificate. The client certificate must be issued by a trusted Certificate Authority and contain valid partner identifier in its subject. ## mTLS Requirements - Certificate must be issued by a trusted Certificate Authority - Certificate must contain a valid partner app ID in the CN (Common Name) field - Certificate must be valid and not expired - Certificate must be presented during the TLS handshake Example certificate subject format: ``` CN=gp_f1a9b6c741c94510bb3b27f2e8379e29,C=US ``` ## Testing the Endpoint Due to browser limitations, this endpoint cannot be tested directly in Swagger UI. Use one of the following methods: ### Using cURL ```bash curl -X POST --cert client.crt --key client.key https://${{AUTHENTICATED_PSE_API_URL}}/api/v1/ephemeral-token ``` **Certificate and Key Format Requirements:** - **Certificate file (`.crt/.pem`)** and **Private key file (`.key/.pem`)**: both must be in PEM format Example certificate format: ``` -----BEGIN CERTIFICATE----- MIIFazCCA1OgAwIBAgIRAIIQz7DSQONZRGPgu2oCiwYwDQYJKoZIhvcNAQELBQAw ... (base64 encoded certificate data) ... -----END CERTIFICATE----- ``` Example private key format: ``` -----BEGIN PRIVATE KEY----- MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQC7VJTUt9Us8cKB ... (base64 encoded private key data) ... -----END PRIVATE KEY----- ``` **Important Notes:** - Ensure certificate and key files have proper line endings - Certificate and key files should be readable by the client application - The private key must correspond to the certificate being used - Certificate must be valid and not expired ### Using Postman 1. Go to Settings > Certificates 2. Add your client certificate and private key 3. Make sure to select the certificate for the correct host ### Using Node.js ```javascript import https from "https"; const httpsAgent = new https.Agent({ cert: CERT, key: KEY, rejectUnauthorized: true, }); const req = https.request( { hostname: "api-pse.gnosispay.com", path: "/api/v1/ephemeral-token", method: "POST", headers: { "Content-Type": "application/json", "User-Agent": "User-Client/1.0.0", }, agent: httpsAgent, }, (res) => { let data = ""; res.on("data", (chunk) => { data += chunk; }); res.on("end", () => { console.log("Status:", res.statusCode); try { const parsedData = JSON.parse(data); console.log("Response:", parsedData); } catch { console.log("Raw response:", data); } }); }, ); req.on("error", (error) => { console.error("Request error:", error); }); req.end(); ``` responses: '200': description: Ephemeral token generated successfully content: application/json: schema: type: object properties: data: type: object properties: token: type: string description: >- The ephemeral token that can be used for PCI operations example: >- 8356ea2b8e7f1d49c2e5f8a76b91c02a3d4f7e10a2c5b9d8e1f4a7c0b3d5e2f expiresAt: type: string format: date-time description: >- The expiration time of the ephemeral token in ISO 8601 format example: '2024-02-07T12:34:56Z' '401': description: Unauthorized - Invalid or missing client certificate content: application/json: schema: type: object properties: error: type: string example: Client certificate required '500': $ref: '#/components/responses/InternalServerError' security: - mtls: [] components: responses: InternalServerError: description: Internal Server Error content: application/json: schema: type: object properties: error: type: string example: Internal Server Error ````