# SDK installation

> The V2 SDK script tag, the version history, the domains for your Content-Security-Policy and which versioning guarantees do not exist.

- kind: guide
- status: stable
- sdk_version: 2.1.1
- last_verified: 2026-10-22
- url: https://tilopay.com/en/developers/sdk/instalacion

## The script [#script]

```html
<script src="https://app.tilopay.com/sdk/v2/sdk_tpay.min.js"></script>
```

Load it before your own checkout code. The SDK exposes the global `Tilopay` object. The
current version is **2.1.1**.

## jQuery is not required [#jquery]

> **Note:** jQuery is NOT required. Since version 2.0.0 the SDK is written in JavaScript: you can
> install it without jQuery on the page.

## Version history [#versiones]

| Version | Date | Change |
|---|---|---|
| 1.0.0 | 29/07/2022 | Tilopay payment form |
| 1.1.0 | 05/10/2022 | Saved cards and SINPE Móvil |
| 2.0.0 | 01/06/2023 | Migration from jQuery to JavaScript |
| 2.1.0 | 30/08/2023 | [`InitTokenize()`](/en/developers/sdk/reference/init-tokenize) to save cards |
| 2.1.1 | — | [Apple Pay](/en/developers/sdk/apple-pay) |

## Domains for Content-Security-Policy [#csp]

If your site uses a Content-Security-Policy, allow the origins the SDK loads:

| Origin | When |
|---|---|
| `https://app.tilopay.com` | Always |
| `https://api.tokenex.com` | Always |
| `https://h.online-metrix.net` | Always |
| `https://storage.googleapis.com` | Always |
| `https://cdn.jsdelivr.net` | Always |
| `https://applepay.cdn-apple.com` | Only if you use [Apple Pay](/en/developers/sdk/apple-pay) |

## What does not exist [#garantias]

> **Warning:** There is no immutable versioning, no SRI hash and no changelog. The
> `/sdk/v2/sdk_tpay.min.js` URL is not pinned to a specific version: its contents can change
> without prior notice and without public release notes.
> 
> Practical consequences:
> 
> - You cannot set `integrity="sha384-..."` on the `script` tag, because the file changes.
> - You cannot rely on a build number to reproduce a bug.
> - Keep smoke tests for your checkout running periodically, not only on deploy.

## Single-page applications [#spa]

Works in React and Vue. Call `Init()` after the fields mount in the DOM: it uses them immediately and fails if they do not exist. Call `Init()` again if the form remounts.

React Native WebView is not tested by Tilopay and may disable Apple Pay; test it in your environment before production.

## What is next [#que-sigue]

- [Form fields](/en/developers/sdk/campos-del-formulario) — the ids the SDK looks for.
- [`Tilopay.Init()`](/en/developers/sdk/reference/init) — start the purchase.