# SDK

> The Parklio SDK lets **your own mobile app** operate Parklio products directly over
> Bluetooth, without a Gateway and without a network connection at the product. It's the
> right path for offline or low-connectivity sites, and for apps that put access in your
> users' hands.

# Parklio SDK

:::info Access
The SDK is private and shared under contract. To request access (Android and iOS),
contact [info@parklio.com](mailto:info@parklio.com). This page explains the flow; the
SDK's own documentation comes with access.
:::

## How it works

![Parklio SDK integration](/img/diagrams/sdk.svg)

1. **Pairing.** The product is paired with your account through the Parklio Connect
   app, once. From then on, the product and Parklio share a secret that every credential
   is derived from.
2. **Your backend creates an operation token** for one product and a time window, with
   [`POST /v2/operation-tokens`](/api/endpoints/operation-tokens-create), using your API
   token. The response holds three signed commands: `token_open`, `token_close` and
   `token_status`.
3. **Your backend gives the token to your app**, for example when a user's booking
   starts. Never put your API token in the app.
4. **Your app sends the command to the product over Bluetooth**, through the SDK. The
   product checks the signature and the time window itself, so no network is needed at
   that point.
5. **The product's state** (open or closed, battery, errors) is broadcast over
   Bluetooth; the SDK reads it, and `token_status` asks the product for a fresh status.

An operation token can't be changed once it's issued. To extend access, create a new
token.

## Rules for your backend

- **Create tokens just in time, with short windows.** Blocking a token
  (`PATCH /v2/operation-tokens/{id}` with `{"status": "blocked"}`) only marks it on the
  server; a copy already in the app keeps working until `end_time`.
- **Don't store tokens long-term**; create a new one when you need it.
- **Give either an `end_time` or `"is_unlimited": true`.** Unlimited tokens are valid
  until 2038-01-01, and can't be revoked on the device: avoid them.
- **Check the product's clock.** If `product_error.rtcc_invalid` is `1`, the product's
  clock isn't set and time-limited tokens fail.

Operation tokens don't need a Gateway.

The backend side is covered step by step in
[Operation tokens for your app](/guides/mobile-app-operation-tokens).

See [Access and keys](/concepts/access-and-keys) for how operation tokens compare with
the other ways to share access.