API · Authentication

The whole API and the SDK live on a single host: https://app.tilopay.com. There is no separate host for testing — see environments.

The two operations#

Get the API token#

curl -X POST https://app.tilopay.com/api/v1/login \
  -H "Content-Type: application/json" \
  -d '{ "apiuser": "YOUR_APIUSER", "password": "YOUR_PASSWORD" }'

Body#

Response#

Get the SDK token#

curl -X POST https://app.tilopay.com/api/v1/loginSdk \
  -H "Content-Type: application/json" \
  -d '{ "apiuser": "YOUR_APIUSER", "password": "YOUR_PASSWORD", "key": "YOUR_API_KEY" }'

The resulting token is the one passed to the token parameter of Tilopay.Init().

Lifetime#

• API token: 24 hours. expires_in arrives as an integer in seconds (for example 86400).
• SDK token: 1 hour. expires_in arrives as a date-time string (for example "2023-06-05 13:32:06").

The exact value always arrives in expires_in, in each operation's format. Cache it server-side and renew on expiry.

How it is sent#

Authorization: bearer <token>

Revocation and limits#

• Tokens cannot be revoked. If a token leaks there is no operation to invalidate it: treat the leak as an incident and rotate credentials with Tilopay.
• There is no limit on concurrent tokens per merchant. You can request one per process without invalidating the previous ones.

Where credentials come from#

apiuser, password and key are obtained in the merchant panel, at Admin panel · Platform integrations. If you do not have access yet, start with developer registration.