SDK installation
SDK 2.1.1The script#
<script src="https://app.tilopay.com/sdk/v2/sdk_tpay.min.js"></script>Load it before your own checkout code. The SDK exposes the global Tilopay object. The
current version is 2.1.1.
jQuery is not required#
jQuery is NOT required. Since version 2.0.0 the SDK is written in JavaScript: you can install it without jQuery on the page.
Version history#
| Version | Date | Change |
|---|---|---|
| 1.0.0 | 29/07/2022 | Tilopay payment form |
| 1.1.0 | 05/10/2022 | Saved cards and SINPE Móvil |
| 2.0.0 | 01/06/2023 | Migration from jQuery to JavaScript |
| 2.1.0 | 30/08/2023 | InitTokenize() to save cards |
| 2.1.1 | — | Apple Pay |
Domains for Content-Security-Policy#
If your site uses a Content-Security-Policy, allow the origins the SDK loads:
| Origin | When |
|---|---|
https://app.tilopay.com | Always |
https://api.tokenex.com | Always |
https://h.online-metrix.net | Always |
https://storage.googleapis.com | Always |
https://cdn.jsdelivr.net | Always |
https://applepay.cdn-apple.com | Only if you use Apple Pay |
What does not exist#
There is no immutable versioning, no SRI hash and no changelog. The
/sdk/v2/sdk_tpay.min.js URL is not pinned to a specific version: its contents can change
without prior notice and without public release notes.
Practical consequences:
- You cannot set
integrity="sha384-..."on thescripttag, because the file changes. - You cannot rely on a build number to reproduce a bug.
- Keep smoke tests for your checkout running periodically, not only on deploy.
Single-page applications#
Works in React and Vue. Call Init() after the fields mount in the DOM: it uses them immediately and fails if they do not exist. Call Init() again if the form remounts.
React Native WebView is not tested by Tilopay and may disable Apple Pay; test it in your environment before production.
What is next#
- Form fields — the ids the SDK looks for.
Tilopay.Init()— start the purchase.
Last verified: 2026-10-22