> For the complete documentation index, see [llms.txt](https://docs.tutelar.io/tutelar-api-document/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.tutelar.io/tutelar-api-document/tutelar-api-document-v2/introduction.md).

# Introduction

### **Tutelar provides single environment to access all available apis**

Base URL : <https://secctrl.tutelar.io/api/v2>&#x20;

| Keys | Description                                                                              |
| ---- | ---------------------------------------------------------------------------------------- |
| Test | This key enabled for developers to test transactions, merchant onboarding and other apis |
| Live | This key enabled for production access.                                                  |

### How to generate your API Secret keys?&#x20;

**Step 1:** Go to the Tutelar client panel and then Select **API Credentials** under **Security Settings.** In the API settings page, you can generate your API keys and use it.

<figure><img src="/files/YG34ugNiAAzhq0R9aDFn" alt=""><figcaption></figcaption></figure>

**Step 2:** On the API credentials page click on the Generate key

<figure><img src="/files/JOlxREKQDuuhoGky1AVV" alt=""><figcaption></figcaption></figure>

**Step 3:** By clicking on the Generate key it will open a popup.

<figure><img src="/files/H6Y5M8VwSsgbiyqmqAkx" alt=""><figcaption></figcaption></figure>

**Step 4:** Once the popup opens, you need to enter the Label name. After that you need to Select Which Product you want to generate API Keys. By default, Expiry Time is set at 6 months, however it can be changed. After giving the respective mode and password the keys will get generated.

<figure><img src="/files/alg031zWEa3ZzxwYIKOQ" alt=""><figcaption></figcaption></figure>

**Step 5:** To view the API key and Secret key click on the "API key" button on the API credential page.

<figure><img src="/files/JW0DhZzSSLpMhrr4x1cn" alt=""><figcaption></figcaption></figure>

### How to add IP whitelisting?

**Step 1:**&#x47;o to the Tutelar client panel and then Select **IP Whitelisting** under **Security Settings.** In the IP Whitelisting page, you can add IP address.

<figure><img src="/files/hlxthEJUvqGWtGWAa1AA" alt=""><figcaption></figcaption></figure>

**Step 2:** On the Add IP address page, Select User Type, Select User, Select IP Type and Enter the Valid IP Address then Click on submit button.

<figure><img src="/files/2HVrrN3PO7m3UxbWX7zP" alt=""><figcaption></figcaption></figure>

**Step 3:**&#x42;y clicking on the submit button IP address has been added successfully.

<figure><img src="/files/0xNh1GYaUu4MCdh8MNMV" alt=""><figcaption></figcaption></figure>

### Generate Access Token for V2 APIs

**Step 1:** Copy the generated **API Key** and **Secret Key** from the API Credentials page.

<figure><img src="/files/uKpCJv159EDXBLmfsPUI" alt=""><figcaption></figcaption></figure>

**Step 2:** Use the generated credentials to call the **Generate Token API**.

<mark style="color:green;">`POST`</mark> **`https://secctrl.tutelar.io/api/generate-token`**

#### Post parameters description is given below

<table><thead><tr><th width="197">Post Parameter </th><th width="139">Type</th><th>Is  Mandatory</th><th>Description</th></tr></thead><tbody><tr><td>username </td><td>String </td><td>Yes </td><td>Your API key to be used as the username</td></tr><tr><td>password</td><td>String </td><td>Yes</td><td>Your Secret key to be used as the password</td></tr></tbody></table>

#### Sample Post Parameters

```json
{
    "username": "tutpk_live_KvW8JlooXglb",
    "password": "tutsk_live_rPpDSThyluyQ20JM8TD2LY9ZJXc8bmyDAyNmFEmc"
}
```

{% tabs %}
{% tab title="200: Success Response" %}

```json
{
    "success": true,
    "code": 14032,
    "message": "Access token generated successfully",
    "data": {
        "access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnWGxRVndTWTdXWTNTN1pDYkJ6ZURRZEx6M1k5Nm9iOCIsImV4cCI6MTc4MDMxMjYzOSwidHlwZSI6ImV4dGVybmFsIiwibW9kZSI6ImxpdmUiLCJwcm9kdWN0Ijp7ImlkIjoiWGZ1emgxWGxEIiwibmFtZSI6Ik1lcmNoYW50IFByb3RlY3QiLCJjb2RlIjoibWVyY2hhbnRfcHJvdGVjdCJ9LCJpYXQiOjE3ODAzMDk5Mzl9.Y2hhbnRfcHJvdGVjdCJ9LCJpYXQiOjE3ODAzMDk5Mzl9 ",
        "refresh_token": "8c4d0ed9f825f98d0759b09195f9ce1fd1dd951653dd459b8bad416d500367de"
    }
}
```

{% endtab %}

{% tab title="422: Validation Error Response" %}

```json
{
    "success": false,
    "code": 14036,
    "message": "Username and Password should be not empty"
}

```

{% endtab %}

{% tab title="403: Forbidden" %}

```json
{
    "success": false,
    "code": 14015,
    "message": "Client API keys not found"
}
```

{% endtab %}

{% tab title="401: Unauthorized" %}

```json
{
    "exp": "token expired"
}
```

{% endtab %}
{% endtabs %}

**Step 3:** Copy the generated **Access Token** and include it in the Authorization header while accessing all V2 API.

```
Authorization: Bearer <access_token>
```

#### Token Expiry Details

<table><thead><tr><th width="382.13671875">Token Type</th><th width="421.65625">Expiry Duration</th></tr></thead><tbody><tr><td>Access Token </td><td>45 Minutes </td></tr><tr><td>Refresh Token</td><td>60 Days </td></tr></tbody></table>

**Step 4:** Once the Access Token expires, use the **`/refresh-token`** API to generate a new Access Token. Use the newly generated Access Token in the **Authorization** header for all subsequent V2 API requests.

### Refresh Access Token

If the Access Token expires, generate a new Access Token using the Refresh Token.

<mark style="color:green;">`POST`</mark> **`https://secctrl.tutelar.io/api/refresh-token`**

#### Post parameters description is given below

<table><thead><tr><th width="197">Post Parameter </th><th width="139">Type</th><th>Is  Mandatory</th><th>Description</th></tr></thead><tbody><tr><td>username </td><td>String </td><td>Yes </td><td>Your API key to be used as the username</td></tr><tr><td>password</td><td>String </td><td>Yes</td><td>Your Secret key to be used as the password</td></tr><tr><td>refresh_token</td><td>String</td><td>Yes</td><td>Your Refresh Token to generate a new access token</td></tr></tbody></table>

#### Sample Post Parameters

```json
{
    "username": "tutpk_live_KvW8JlooXglb",
    "password": "tutsk_live_rPpDSThyluyQ20JM8TD2LY9ZJXc8bmyDAyNmFEmc",
    "refresh_token": "8c4d0ed9f825f98d0759b09195f9ce1fd1dd951653dd459b8bad416d500367de"
}
```

{% tabs %}
{% tab title="200: Success Response" %}

```json
{
    "success": true,
    "code": 14032,
    "message": "Access token generated successfully",
    "data": {
        "access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnWGxRVndTWTdXWTNTN1pDYkJ6ZURRZEx6M1k5Nm9iOCIsImV4cCI6MTc4MDMxMjYzOSwidHlwZSI6ImV4dGVybmFsIiwibW9kZSI6ImxpdmUiLCJwcm9kdWN0Ijp7ImlkIjoiWGZ1emgxWGxEIiwibmFtZSI6Ik1lcmNoYW50IFByb3RlY3QiLCJjb2RlIjoibWVyY2hhbnRfcHJvdGVjdCJ9LCJpYXQiOjE3ODAzMDk5Mzl9.Y2hhbnRfcHJvdGVjdCJ9LCJpYXQiOjE3ODAzMDk5Mzl9 ",
        "refresh_token": "8c4d0ed9f825f98d0759b09195f9ce1fd1dd951653dd459b8bad416d500367de"
    }
}
```

{% endtab %}

{% tab title="422: Validation Error Response" %}

```json
{
    "success": false,
    "code": 14036,
    "message": "Username and Password should be not empty"
}

{
    "success": false,
    "code": 14033,
    "message": "Refresh token should not be empty"
}

```

{% endtab %}

{% tab title="403: Forbidden" %}

```json
{
    "success": false,
    "code": 14015,
    "message": "Client API keys not found"
}
```

{% endtab %}

{% tab title="401: Unauthorized" %}

```json
{
    "success": false,
    "code": 14035,
    "message": "Invalid Refresh Token"
}
{
    "success": false,
    "code": 14035,
    "message": "Refresh Token Expired"
}
```

{% endtab %}
{% endtabs %}

If the Refresh Token has expired, a new Access Token and Refresh Token pair must be generated using the **`/generate-token`** API.