API · Authentication

The whole API and the SDK live on a single host: https://app.tilopay.com. There is no separate host for testing — see environments.

The two operations#

loginSdk is the method the previous article called "GetTokenSdk". It is the same one.

Get the API token#

curl -X POST https://app.tilopay.com/api/v1/login \
  -H "Content-Type: application/json" \
  -d '{ "apiuser": "YOUR_APIUSER", "password": "YOUR_PASSWORD" }'

Body#

Response#

Get the SDK token#

curl -X POST https://app.tilopay.com/api/v1/loginSdk \
  -H "Content-Type: application/json" \
  -d '{ "apiuser": "YOUR_APIUSER", "password": "YOUR_PASSWORD" }'

The resulting token is the one passed to the token parameter of Tilopay.Init().

Lifetime#

• API token: 24 hours.
• SDK token: 1 hour.

The exact value always arrives in expires_in. Cache it server-side and renew on expiry.

How it is sent#

Authorization: bearer <token>

Revocation and limits#

• Tokens cannot be revoked. If a token leaks there is no operation to invalidate it: treat the leak as an incident and rotate credentials with Tilopay.
• There is no limit on concurrent tokens per merchant. You can request one per process without invalidating the previous ones.

Where credentials come from#

apiuser, password and key are obtained in the merchant panel at admin.tilopay.com/admin/checkout. If you do not have access yet, start with developer registration.