> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tonder.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Integration & Security Essentials

This section covers the essential requirements for integrating with the Tonder Withdrawals API, including authentication, security best practices, and data format specifications.

## Base URLs

The Withdrawals API is available in two environments:

| Environment | Base URL (v1)                    | Purpose                 |
| ----------- | -------------------------------- | ----------------------- |
| Stage       | `https://stage.tonder.io/api/v1` | Development and testing |
| Production  | `https://prod.tonder.io/api/v1`  | Live transactions       |

<Note>
  Always use the correct base URL for your environment. Using production URLs in stage or vice-versa will result in authentication errors.
</Note>

## Authentication

<Warning>
  **Authentication Required for All Requests**

  **Every single request** to the Withdrawals API requires authentication using a token in the `Authorization` header. This applies to:

  * All API requests (cURL, HTTP clients, SDKs)
  * All Postman requests
  * All testing requests
  * All production requests

  Requests without proper authentication will return a `401 Unauthorized` error.
</Warning>

### Header Format

Include your API token in the Authorization header with the following format:

```http theme={null}
Authorization: Token 304fbdd63113c009b6ac14c7d230b13909ae11221
```

<Note>
  **Getting Your API Token**

  This is a sample token. You need to use the one provided by Tonder in the **Developers section** of our platform. Log in to your Tonder dashboard and navigate to the Developers section to retrieve your API key.
</Note>

### Example Request (cURL)

```bash theme={null}
curl -X POST https://stage.tonder.io/api/v1/withdrawals/ \
  -H "Authorization: Token YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "user_id": 12345,
    "amount": 1000.00,
    "currency": "MXN",
    "transfer_method": "SPEI",
    ...
  }'
```

### Using Postman

When making requests in Postman:

1. **Set the Authorization Header**:
   * Go to the **Headers** tab
   * Add a new header:
     * **Key**: `Authorization`
     * **Value**: `Token YOUR_API_KEY` (replace `YOUR_API_KEY` with your actual token)

2. **Alternative: Use Postman Authorization Tab**:
   * Go to the **Authorization** tab
   * Select **Type**: `No Auth` (then manually add header) OR use a custom type
   * Add header: `Authorization: Token YOUR_API_KEY`

3. **Example Postman Setup**:
   ```
   Method: POST
   URL: https://stage.tonder.io/api/v1/withdrawals/
   Headers:
     Authorization: Token 304fbdd63113c009b6ac14c7d230b13909ae11221
     Content-Type: application/json
   Body: (raw JSON with your request data)
   ```

<Info>
  **Token Format**

  The token must be prefixed with the word "Token" followed by a space, then your actual API key. The format is: `Token <your_api_key>`
</Info>

<Warning>
  **Security Best Practices**

  * Always use HTTPS for communications
  * Never expose your secret API key in client-side code
  * Store API keys securely on your server
  * Set up alerts for unusual withdrawal patterns
</Warning>

## Data Format Requirements

### Timestamps

All timestamps must be in **ISO 8601 format**.

Examples:

* `2024-07-26T10:30:00Z`
* `2024-07-26T10:30:00+00:00`

### Currency Amounts

Currency amounts must be provided as **decimal numbers**.

Examples:

* `1000.00` (correct)
* `1000` (correct)
* `"1000.00"` (incorrect - should not be a string)

### JSON Content Type

All requests with a body must include the `Content-Type: application/json` header.

## Next Steps

* Learn about [environment configuration](/withdrawals-api/environments)
* Review the [create withdrawal guide](/withdrawals-api/guides/create-withdrawal) to see authentication in action
* Check [HTTP response codes](/withdrawals-api/reference/http-response-codes) to understand API responses