> ## Documentation Index
> Fetch the complete documentation index at: https://gnosispay-feat-changelog-feature.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Generate a new ephemeral token

> Generates a new ephemeral token for secure PCI operations.

Ephemeral tokens are single-use tokens with a short lifespan (60 seconds) that are used to authorize sensitive
PCI operations like retrieving card details or setting a PIN.

This endpoint requires mTLS (Mutual TLS) authentication using a valid client certificate.

The client certificate must be issued by a trusted Certificate Authority and contain valid
partner identifier in its subject.

## mTLS Requirements
- Certificate must be issued by a trusted Certificate Authority
- Certificate must contain a valid partner app ID in the CN (Common Name) field
- Certificate must be valid and not expired
- Certificate must be presented during the TLS handshake

Example certificate subject format:
```
CN=gp_f1a9b6c741c94510bb3b27f2e8379e29,C=US
```

## Testing the Endpoint
Due to browser limitations, this endpoint cannot be tested directly in Swagger UI. Use one of the following methods:

### Using cURL
```bash
curl -X POST --cert client.crt --key client.key https://${{AUTHENTICATED_PSE_API_URL}}/api/v1/ephemeral-token
```

**Certificate and Key Format Requirements:**
- **Certificate file (`.crt/.pem`)** and **Private key file (`.key/.pem`)**: both must be in PEM format

Example certificate format:
```
-----BEGIN CERTIFICATE-----
MIIFazCCA1OgAwIBAgIRAIIQz7DSQONZRGPgu2oCiwYwDQYJKoZIhvcNAQELBQAw
... (base64 encoded certificate data) ...
-----END CERTIFICATE-----
```

Example private key format:
```
-----BEGIN PRIVATE KEY-----
MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQC7VJTUt9Us8cKB
... (base64 encoded private key data) ...
-----END PRIVATE KEY-----
```

**Important Notes:**
- Ensure certificate and key files have proper line endings
- Certificate and key files should be readable by the client application
- The private key must correspond to the certificate being used
- Certificate must be valid and not expired

### Using Postman
1. Go to Settings > Certificates
2. Add your client certificate and private key
3. Make sure to select the certificate for the correct host

### Using Node.js
```javascript
import https from "https";

const httpsAgent = new https.Agent({
  cert: CERT,
  key: KEY,
  rejectUnauthorized: true,
});

const req = https.request(
  {
    hostname: "api-pse.gnosispay.com",
    path: "/api/v1/ephemeral-token",
    method: "POST",
    headers: {
      "Content-Type": "application/json",
      "User-Agent": "User-Client/1.0.0",
    },
    agent: httpsAgent,
  },
  (res) => {
    let data = "";
    res.on("data", (chunk) => {
      data += chunk;
    });

    res.on("end", () => {
      console.log("Status:", res.statusCode);

      try {
        const parsedData = JSON.parse(data);
        console.log("Response:", parsedData);
      } catch {
        console.log("Raw response:", data);
      }
    });
  },
);

req.on("error", (error) => {
  console.error("Request error:", error);
});
req.end();
```