## Overview
Yonyou YonBIP / YonSuite self-built applications do not use a password grant. Instead, the caller exchanges an AppKey, a millisecond timestamp and an HmacSHA256 signature for an access_token via this endpoint, then passes the token on every business API call.
### Signature algorithm
1. Prepare appKey and timestamp (Unix epoch in milliseconds).
2. Sort all parameters ascending by name and concatenate them as key1value1key2value2.
3. Compute HmacSHA256 of the concatenated string using AppSecret as the key.
4. Base64-encode the digest, then URLEncode it — that is the signature.
5. Issue a GET request with appKey, timestamp and signature.
### Response and usage
- The JSON payload carries data.access_token with an expires_in of roughly 7200 seconds (2 hours).
- Cache the token locally and reuse it until expiry; fetching a fresh token per request will hit rate limits.
- The Qeasy connector implements both the signature and the token cache, so tenants only supply AppKey/AppSecret.
### Common pitfalls
Clock skew beyond the allowed window, forgetting to sort parameters before concatenation, and skipping URLEncode after Base64 are the three most frequent causes of signature-verification failures.
### Self-built vs ISV mode
This page covers the direct mode for self-built apps. An ISV serving many tenants must instead use the suite flow: receive suiteTicket push events, exchange suiteKey plus suiteSecret for a suiteAccessToken, then mint per-tenant tokens. The credential systems are entirely different, so confirm the application form before choosing an integration approach.