# TotalCtrl API Overview

**Category:** [Developer & API](https://help.totalctrl.app/hc/totalctrl/totalctrl-help-center/en-US/categories/developer-api)
**Updated:** 2026-08-19

## API basics

TotalCtrl provides a REST API for programmatic access to your organisation's data. All API endpoints are under `/api/v1/` and return JSON.

## Authentication

Use **API token key + secret** pairs for server-to-server requests. For mobile or single-page applications, use the **JWT-based mobile auth** flow:

  
- `POST /api/v1/auth/token` — login and receive an access token (15-min TTL) and refresh token (30-day TTL).
  
- `POST /api/v1/auth/refresh` — exchange a refresh token for a new access token.
  
- Pass the access token as `Authorization: Bearer <token>` on subsequent requests.

---

## Related Articles

- [MCP Server](https://help.totalctrl.app/en-US/articles/mcp-server)

---
[← Back to TotalCtrl Help Center](https://help.totalctrl.app/en-US/)