# Get Token

> Every API request is authenticated with your **Token API** in the `Token` header (some endpoints also need your `ShopId`). You create and reveal the token in the GHN customer portal, under your account's **Bảo mật** (Security) settings.

## Where to log in

| Environment | URL |
| --- | --- |
| Production | https://khachhang.ghn.vn |
| Staging | https://5sao.ghn.dev |

## Steps

1. Open the portal for your environment, enter your phone number, pass the verification, then press **Tiếp tục** (Continue). You can also sign in with Google, Apple, or the internal GHN login.

![Log in with your phone number on the GHN customer portal](https://developer.ghn.vn/docs-assets/token/step-1-login.png)

2. After signing in you land on the **Chủ cửa hàng** (Shop owner) dashboard. Open your account from the panel in the top-left corner.

![The Chủ cửa hàng dashboard — open your account from the top-left panel](https://developer.ghn.vn/docs-assets/token/step-2-shop-owner.png)

3. On the account page, open the **Bảo mật** (Security) tab, find **Token API & IP tin cậy** (API token & trusted IPs), then click **Quản lý** (Manage).

![Account → Bảo mật (Security) → Token API & IP tin cậy → Quản lý](https://developer.ghn.vn/docs-assets/token/step-3-token.png)

4. Click the **eye icon** to reveal your **Token API**, then copy it. Optionally, limit which servers can use the token by adding trusted IPs under **Danh sách IP được phép sử dụng** — by default every IP can call the API.

![Reveal the Token API with the eye icon; optionally add trusted IPs](https://developer.ghn.vn/docs-assets/token/step-4.png)

## Use it

```bash
curl -X GET "https://online-gateway.ghn.vn/shiip/public-api/master-data/province" \
  -H "Token: <your-token>" \
  -H "ShopId: <your-shop-id>"
```

## Notes

- Keep your token secret — treat it like a password.
- Staging (`5sao.ghn.dev`) and Production (`khachhang.ghn.vn`) are separate accounts with **separate** tokens.
- By default the token works from any IP. To harden it, add your servers' public IPs to the trusted-IP list; once the list is non-empty, only those IPs may call the API.
- Some endpoints also need your `ShopId`, shown in your account information.