# API · Get SDK token

> SDK login: returns the token that Tilopay.Init() uses in the browser.

- kind: api-operation
- status: stable
- api_version: v1
- last_verified: 2026-10-20
- url: https://tilopay.com/en/developers/api/autenticacion/token-sdk

```http
POST /api/v1/loginSdk
```

## What it does [#que-hace]

Returns the security token needed to consume the SDK. All three credentials come from [Admin panel · Platform integrations](https://admin.tilopay.com/platform-integrations).

## Authentication [#autenticacion]

It does not require a token: this is the operation that issues it. See [authentication](/en/developers/api/autenticacion).

> **Warning:** This login runs on your server, never in the browser. `apiuser`, `password` and `key`
> are merchant secrets: they are never exposed in the frontend. Only the token returned by
> this operation reaches the browser.

## Parameters [#parametros]

<Param id="token-sdk-parametro-apiuser" name="apiuser" type="string" required>
Merchant API user.
</Param>

<Param id="token-sdk-parametro-password" name="password" type="string" required>
Merchant API password.
</Param>

<Param id="token-sdk-parametro-key" name="key" type="string" required>
Merchant api key.
</Param>

## Request example [#request]

The `<...>` values are placeholders: replace them with your own credentials and data.

```json
{
  "apiuser": "<api_user>",
  "password": "<api_password>",
  "key": "<api_key>"
}
```

## Response [#respuesta]

```json
{
  "access_token": "351d477adaaa51cdbb33ae4b4b8c843aa759f131c1c38415180b5035543d59d2f23f4e049706f5fa71c5f0d9ff763960a3cd035b4c1cefa428c90bedb672f780",
  "token_type": "bearer",
  "expires_in": "2023-06-05 13:32:06"
}
```

## Error responses [#respuestas-de-error]

Invalid credentials → HTTP 401:

```json
{
  "error": "Unauthorized"
}
```

To interpret a response that is not a success, see [how to read an error response](/en/developers/api/procesos-operativos/errors).