# API · Four integration paths

> The four ways to take payments with Tilopay, and the difference that decides which one fits you: where the card data travels.

- kind: concept
- status: stable
- api_version: v1
- last_verified: 2026-10-20
- url: https://tilopay.com/en/developers/api/caminos-de-integracion

## Four paths [#cuatro-caminos]

There are four ways to take payments with Tilopay. They differ in two things: how much you
build yourself, and where the card fields appear. Pick one and follow its guide; all of them
start with your sandbox credentials, requested at [developer registration](/en/developers/registro).

### 1 · No code [#sin-codigo]

Extensions and plugins for existing platforms. You do not write a line of code.

[See path](/en/developers/sin-codigo)

### 2 · Hosted payment page [#hosted-payment-page]

Your server requests a URL from the API, redirects the customer to that Tilopay page and
receives the result on your callback URL.

[See path](/en/developers/hosted-payment-page)

### 3 · JavaScript SDK [#sdk-javascript]

The card fields live in your page; the SDK captures them and sends them straight to Tilopay.

[See path](/en/developers/sdk)

### 4 · Server-to-server API [#servidor-a-servidor]

Restricted access: a service exclusive to PCI-certified merchants. The URL is provisioned per
merchant and is not public.

[Requirements and request](/en/developers/server-to-server)

## How to choose [#como-elegir]

Choosing the wrong path is expensive. The difference that matters most is where the card data
travels.

| Path | Who builds the form | Where card data travels | What you need to know | Compliance implication |
| --- | --- | --- | --- | --- |
| 1 · No code | The platform | Never pass through your systems | Setup inside the platform admin | Check with your compliance team |
| 2 · Hosted payment page | Tilopay | Your customer types them on a secure Tilopay page; you never see a card number | Backend: request the URL and handle the callback | Check with your compliance team |
| 3 · JavaScript SDK | Your site | Typed on your page but sent from the browser straight to Tilopay; they do not pass through your server | JavaScript frontend, plus backend for credentials | Check with your compliance team |
| 4 · Server-to-server (restricted access) | Your site | Card data passes through your server | Requires your PCI certification and a URL provisioned by Tilopay | Check with your compliance team |

> **Warning:** Path 4 is not self-serve: it is exclusive to merchants holding PCI certification, and the URL
> is provisioned individually. It is also the only path that puts your server inside PCI DSS
> scope. Paths 2 and 3 avoid that cost and you can start them today.

## After you choose [#despues-de-elegir]

With the path picked, continue with [response conventions](/en/developers/api/convenciones) to
learn how amounts are typed, and [how to read an error response](/en/developers/api/procesos-operativos/errors)
before you put the code into production.

[Saved card payments reference](/en/developers/api/cobros-tarjetas-guardadas).