Ctrl+K

Get internal access token

get/api/v2/user/internalaccesstoken

Retrieves the authenticated user's long-lived internal access token in encrypted form. The plaintext token is never transmitted. Instead, the response includes an ECDH-encrypted representation (encryptedToken) and the derivationPath the client needs to derive the shared secret for decryption using the user's ecdhKeychain.

This endpoint is reachable via the public API path but is excluded from external documentation. It will be moved to an internal-only route once BG-21669 is completed.

200 Response

encryptedToken string required
The access token encrypted using ECDH with the user's ecdhKeychain xpub
derivationPath string required
BIP32 derivation path used to derive the ECDH keypair for decryption
id string required
Example: 59cd72485007a239fb00282ed480da1f
Match pattern: ^[0-9a-f]{32}$
isExtensible boolean required
bitgoAdminPermissions array[string]
client string
created string <date-time>
enterprise string
expires string <date-time>
extensionAddress string
ip string <ipv4>
IP address of the client that requested this access token
Example: 127.0.0.1
ipRestrict array[string]
IP addresses or CIDR block of clients that are allowed to use this token
label string
origin string
BitGo environment that issued this token
Example: test.bitgo.com
token string
scope array[string]
Session permissions
Example: ["crypto_compare","user_manage","openid","profile","wallet_create","wallet_manage_all","wallet_approve_all","wallet_spend_all","wallet_edit_all","wallet_view_all"]
unlock object
spendingLimits dictionary<string, object>
allErc20TokensLimit object
expires string <date-time>
time string <date-time>
txCount number
txValue number
txValueLimit number
user string
Example: 59cd72485007a239fb00282ed480da1f
Match pattern: ^[0-9a-f]{32}$
oauth object
oauthRequired boolean
expires string <date-time>
isMobileAccessToken boolean
Flag indicating if this token was created via mobile session endpoint

401 Response

name string
Error code
context object required
Properties that apply to a specific error name
error string required
Human-readable error message
requestId string required
Client request id

403 Response

name string
Error code
context object required
Properties that apply to a specific error name
error string required
Human-readable error message
requestId string required
Client request id

404 Response

name string
Error code
context object required
Properties that apply to a specific error name
error string required
Human-readable error message
requestId string required
Client request id

424 Response

name string
Error code
context object required
Properties that apply to a specific error name
error string required
Human-readable error message
requestId string required
Client request id