# Authentication & API Keys

Tumr supports two primary modes of authentication depending on whether you are building server-to-server merchant integrations or authenticating interactive client dashboards.

1. Secret API Keys (Server-to-Server) Secret API keys are designed for backend services, e-commerce plug-ins, and automated scheduling systems.

Include the API key in the standard Authorization header: ``http Authorization: Bearer ak_live_sec_1092a48d8291f0923...

API Key Prefix Conventions - ak_live_...: Production API keys. Real charges and live dispatching apply. - ak_test_...: Sandbox API keys. Uses mock courier rates, sandbox wallets, and simulated rider movements.

2. JWT Bearer Tokens (Dashboard & Mobile) Used by user-facing applications (such as the Tumr Business Dashboard and Rider mobile app).

1. Authenticate using the [Login Endpoint](/en/docs/api-reference/auth/):
2. ```http
3. POST /api/v1/auth/login/
4. Content-Type: application/json

{ "email": "[email protected]", "password": "SecurePassword123!" } ```

1. Use the returned access token in subsequent requests:
2. ```http
3. Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
4. `

Access tokens expire after 60 minutes. Use the refresh token with POST /api/v1/auth/refresh/ to obtain fresh credentials without prompting the user to re-authenticate.