# API · Authentication

> How to get the API token and the SDK token, how long each lasts, and how to send them on every call.

- kind: api-operation
- status: stable
- api_version: v1
- last_verified: 2026-10-20
- url: https://tilopay.com/en/developers/api/autenticacion

The whole API and the SDK live on a single host: `https://app.tilopay.com`. There is no
separate host for testing — see [environments](/en/developers/entornos).

## The two operations [#operaciones]

| Operation | Path | What for |
|---|---|---|
| API token | `POST /api/v1/login` | Server-to-server API calls |
| SDK token | `POST /api/v1/loginSdk` | The token passed to `Tilopay.Init()` |

## Get the API token [#token-api]

```bash
curl -X POST https://app.tilopay.com/api/v1/login \
  -H "Content-Type: application/json" \
  -d '{ "apiuser": "YOUR_APIUSER", "password": "YOUR_PASSWORD" }'
```

### Body [#cuerpo]

<Param id="login-apiuser" name="apiuser" type="string" required>
The merchant API user.
</Param>

<Param id="login-password" name="password" type="string" required>
The merchant API password.
</Param>

### Response [#respuesta]

<Param id="login-access-token" name="access_token" type="string">
The token to send on subsequent calls.
</Param>

<Param id="login-token-type" name="token_type" type="string">
Always `bearer`.
</Param>

<Param id="login-expires-in" name="expires_in" type="integer">
Token lifetime as an **integer in seconds** (for example `86400`). The exact value comes in
this response: do not assume it on the client.
</Param>

## Get the SDK token [#token-sdk]

```bash
curl -X POST https://app.tilopay.com/api/v1/loginSdk \
  -H "Content-Type: application/json" \
  -d '{ "apiuser": "YOUR_APIUSER", "password": "YOUR_PASSWORD", "key": "YOUR_API_KEY" }'
```

The resulting token is the one passed to the `token` parameter of
[`Tilopay.Init()`](/en/developers/sdk/reference/init).

## Lifetime [#vigencia]

- **API token: 24 hours.** `expires_in` arrives as an **integer in seconds** (for example
  `86400`).
- **SDK token: 1 hour.** `expires_in` arrives as a **date-time string** (for example
  `"2023-06-05 13:32:06"`).

The exact value always arrives in `expires_in`, in each operation's format. Cache it
server-side and renew on expiry.

## How it is sent [#envio]

```http
Authorization: bearer <token>
```

## Revocation and limits [#revocacion]

- **Tokens cannot be revoked.** If a token leaks there is no operation to invalidate it:
  treat the leak as an incident and rotate credentials with Tilopay.
- **There is no limit** on concurrent tokens per merchant. You can request one per process
  without invalidating the previous ones.

## Where credentials come from [#credenciales]

`apiuser`, `password` and `key` are obtained in the merchant panel, at
[Admin panel · Platform integrations](https://admin.tilopay.com/platform-integrations).
If you do not have access yet, start with [developer registration](/en/developers/registro).

> **Warning:** Never put `apiuser` or `password` in the browser. The login runs on your server; only the
> SDK token reaches the browser.