# Get Token

> Every API request is authenticated with your **Token API** in the `Token` header (some endpoints also need your `ShopId`). You can grab the token yourself in a couple of minutes in the GHN Developer Portal, under **Manage token** in your account — no need to ask GHN to issue one.

## Where to log in

| Environment | URL |
| --- | --- |
| Production | https://developer.ghn.vn |
| Staging | https://developer.ghn.dev |

## Steps

1. Open the Developer Portal for your environment, then press **Log in** at the right end of the header.

![The Developer Portal home page with the Log in button at the right end of the header](https://developer.ghn.dev/docs-assets/token/step-1-developer-home.png)

2. Sign in with your phone number and pass the verification step.

![The login screen — enter a phone number, or choose Google, Apple, or the internal GHN login](https://developer.ghn.dev/docs-assets/token/step-1-login.png)

3. Once signed in, open the account menu at the right end of the header and choose [Manage token](/account).

![The account menu open, showing Manage token, Webhook settings, and Log out](https://developer.ghn.dev/docs-assets/token/step-3-account-menu.png)

4. On the **Token API** card, click the **eye icon**. A 6-digit OTP is sent to the phone number on the account; enter that code to reveal the token, then click the **copy icon** to copy it.

![The Token API card after entering the OTP — the token is now visible and the copy button is enabled](https://developer.ghn.dev/docs-assets/token/step-4-token-revealed.png)

5. Optional but recommended: limit which servers can use the token by adding IPs to **Danh sách IP được phép sử dụng** (Allowed IP list) right below the Token API card. While the list is empty, any IP can call the API; as soon as you add the first IP, only those IPs may call it — so add every server's IP before you go to production.

6. Need order-status or ticket callbacks? From the same account menu, choose [Webhook configuration](/account/webhook) and you can register your endpoints yourself — see [Order Status Callback](https://developer.ghn.dev/en/docs/webhook/callback-order-status.md).

## Use it

```bash
curl -X GET "https://online-gateway.ghn.vn/shiip/public-api/master-data/province" \
  -H "Token: <your-token>" \
  -H "ShopId: <your-shop-id>"
```

## Notes

- **Keep your token secret** — treat it like a password. Never commit it to git or expose it in browser-side code.
- **Staging and Production are separate accounts** with **separate** tokens. A `developer.ghn.dev` token will not work against Production.
- By default the token works from any IP. To harden it, add your servers' public IPs to the allowed-IP list — once the list is non-empty, only those IPs may call the API.
- Some endpoints also need your `ShopId`, shown in your account information.