Tokens

Three credentials appear in overseas integrations. They are not interchangeable.

Administrator accessToken


How you get it	accessToken with `AppId` / `AppSecret`. Host: `https://openapi-[DataCenter].easy4ip.com/openapi/accessToken`.
Lifetime	3 days. Refresh when it is about to expire or the API returns `TK1002`. Each token has an independent 3-day life; do not mint one per request.
Where it lives	Your server or secrets manager only.
What it can do	OpenAPI calls for the developer account, including v2 capabilities and push configuration.

Do not give this token to app users. A leak can operate every device on the account. See Sub-accounts and policies.


How you get it	subAccountToken with the administrator token and the sub-account `openid`. Host: `https://openapi-[DataCenter].easy4ip.com/openapi/subAccountToken`.
Lifetime	The method returns `expireTime` in seconds. This book does not state a fixed calendar length beyond that field.
Where it lives	Your server, then the client that must act as that user.
What it can do	Only the devices and permission identifiers granted by the policy.

Create the sub-account and attach policies first: Account APIs. Prefix in the sample is St_.


How you get it	Server-side `getKitToken` at `https://openapi-[DataCenter].easy4ip.com/openapi/getKitToken`. Protocol: JavaScript development §1.5.
Lifetime	2 hours. Cache about one hour in your service. `expireTime` in the sample is remaining seconds (7199).
Where it lives	Minted on the server, then passed to ImouPlayer. Never computed in the browser.
What it can do	Light-app play for the `deviceId` / `channelId` / `type` you requested (`0` all, `1` live, `2` playback, `6` PTZ).

The player field named token is this kitToken, not the administrator accessToken.