# Generate Access Token

### BCA APIs is using OAuth 2.0 as the authorization framework. To get the access token, you need to be authorized by `client_id` and `client_secret`. To learn more about the OAuth 2.0 authorization framework

<figure><img src="https://2592634121-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FT5HLPrqZhkeNGgJP37dC%2Fuploads%2FxYi2TYdCssNXg4rGa1i2%2FScreen%20Shot%202022-09-13%20at%2001.52.25.png?alt=media&#x26;token=5fe4cc5d-3a19-44dc-946a-1563e9223770" alt=""><figcaption></figcaption></figure>

#### **Request Headers**

| Name          | Format                                  | Mandatory |
| ------------- | --------------------------------------- | --------- |
| Authorization | Basic `base64(client_id:client_secret)` | yes       |

Code

{% code title="AccessToken.js" %}

```javascript
const crypto = require('crypto');
const axios = require("axios").default;

//generate access token

const client_id ='96951f24-f6c4-4583-89c0-87fa6489d04a';
const client_secret ='54ed876c-c7d2-4b84-b615-35c26e0d5fce';
var Sign =Buffer.from(`${client_id}:${client_secret}`).toString('base64');
console.log(Sign);



  try {
    const result = await axios.post(`sandbox.bca.co.id/api/oauth/token`,new URLSearchParams({
      grant_type: 'client_credentials'
    }),{    headers: { 
      'Authorization': `Basic ${Sign}`, 
      'Content-Type': 'application/x-www-form-urlencoded',      
    },
});
    return res.status(201).send(result.data);
  } catch (err) {
  return res.status(400).send(err.response.data); ;    
  }




```

{% endcode %}
