> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tunimobile.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Terminal API key

> Identify each printing device, and see which credential each endpoint needs.

Each device (phone, POS, PC) that prints vouchers is a **terminal** linked to the shop. A terminal is identified by an API key that **you generate** once per device (for example a UUID), store on the device, and register with [Register / check the terminal](https://docs.tunimobile.com/api/terminal/register.md).

The voucher and session calls identify the terminal through an HTTP header:

```http theme={null}
api-key: <your terminal API key>
```

> [!WARNING]
>
> Keep the key secret: anyone with it can print vouchers on the shop's balance.

## Who can call what

| Endpoint | Login (cookie / Bearer) | Terminal `api-key` header |
| - | - | - |
| [Log in](https://docs.tunimobile.com/api/auth/login.md), [Refresh](https://docs.tunimobile.com/api/auth/refresh.md) | not needed | not needed |
| [Profile](https://docs.tunimobile.com/api/account/profile.md), [Balance](https://docs.tunimobile.com/api/account/balance.md), [Register terminal](https://docs.tunimobile.com/api/terminal/register.md), [Voucher history](https://docs.tunimobile.com/api/vouchers/history.md), [Log out](https://docs.tunimobile.com/api/auth/logout.md) | **required** | not needed |
| [`printVoucher`](https://docs.tunimobile.com/api/vouchers/generate), [`confirmVoucher`](https://docs.tunimobile.com/api/vouchers/confirm) | not needed | **required** |
| [`reprintVoucher`](https://docs.tunimobile.com/api/vouchers/reprint), [`duplicateVoucher`](https://docs.tunimobile.com/api/vouchers/duplicate), [`confirmReprintVoucher`](https://docs.tunimobile.com/api/vouchers/confirm-reprint) | **either** login as the shop owner **or** the API key of the terminal that printed the voucher | |
| [Open / close session](https://docs.tunimobile.com/api/sessions/rotate.md) | not needed | **required** |

For reprint, duplicate and confirm-reprint, either credential is enough. The device can call them with its API key and no login, and the shop owner can call them from a back office with a login and no API key. Any other caller gets `403 access_denied`.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.