# Apika mobile shared-token channel

Use `temp_model=shared_token` with template key `sim_onelink_kedang_v1`.

Set `token.baseUrl` to `http://test.iotapi.apika.cn` in the test environment
or `https://iotapi.apika.cn` in production. The token path is
`/iot-api/iot-card-info/getRefreshToken`.

Channel fields:

- `app_key`: Apika `appKey`, sent in the request header and body.
- `app_secret`: Apika `appSecret`, sent in the request header and body and used
  to calculate the signature.
- `chan_config`: `{"appId":"..."}`; `appId` is sent as JSON field `appid`.

The request sends `appKey`, `appSecret`, and `signature` in both the headers
and JSON body. The JSON body also contains `appid`.

The signature is calculated by building `{appKey}:{appSecret}` with the
literal braces, hashing its UTF-8 bytes with SHA-256, converting the digest to
uppercase hexadecimal, and Base64-encoding that hexadecimal string.

The returned `data.shareToken` is cached for five minutes and refreshed thirty
seconds before expiry. The returned `transid` is not used as the OneLink
business request transaction ID.