Skip to main content
Two tokens. One you keep, one you throw away every hour.

​
Get your refresh token

In the dashboard, go to Settings → API Integrations and press Connect. That produces your refresh_token. It is permanent, and it is the only long-lived credential you hold. It cannot be used to call anything except the token endpoint.
Treat the refresh token as a passwordIt does not expire, so a leaked one stays useful to whoever has it until somebody notices and regenerates it.It belongs in a secrets manager or an environment variable — never in client-side code, a mobile app bundle, a repository, a support ticket or a screenshot. Anything that reaches a browser can be read by the person using that browser.

​
Exchange it for an access token

POST /rest/v2/refreshToken Free+
The response carries an access_token with a lifetime of one hour. Send it on every other call:
Cache the access token; do not fetch one per requestA token is valid for an hour, so a job that calls the API a thousand times in that hour needs one token, not a thousand.The pattern that holds up: keep the token and its expiry in memory, refresh when it is within a few minutes of expiring, and refresh again on a 401 rather than assuming your clock and theirs agree. Requesting a fresh token per call is the single most common way an integration becomes slow.

​
Check the connection

GET /rest/v2/healthCheck Free+ Confirms the platform is reachable and responding. Worth wiring into your own monitoring, so that when something breaks you already know which side it broke on.

​
The sandbox

A separate environment with its own account, its own token and test carriers, at https://staging-api.tryoto.com. Same paths, same shapes.
Build against the sandbox, but test the switchThe sandbox is where you create orders that do not become real parcels and bookings that do not become real invoices. Nothing else is safe to iterate against.The failure to plan for is the cutover: production has different carrier contracts, different hubs and different codes. A configuration value hard-coded during development is the classic first-day-live incident, so keep every environment-specific value in configuration from the first commit.

​
Plan availability

Endpoints are gated by subscription tier, and some also require an add-on. Every endpoint in the index carries the lowest plan that includes it.
Ship-from-store over the API is an Enterprise capabilityPickup locations can be created on every plan, but only as warehouses. Creating one of type: "branch" — a shop that also ships — is Enterprise only.If your plan is to make stores fulfill orders programmatically, that is the line to check before you design around it. See Hubs Management for what a branch is and why it matters.