For regular Multilogin API automation, use an automation token. It lasts longer, so you don't need to refresh your token every 30 minutes. Use API sign-in only when your integration needs to log in automatically, without someone copying a token from the Multilogin dashboard. 

➡️ In Postman, go to “Profile Access Management” → “User Sign In” → enter your email and MD5 password hash → click “Send”.

The “User Sign In” request gives you a regular API token and a refresh token. You can then use “User Refresh Token (Switch Workspace)” to get new tokens without signing in again.

Before you start

Install Postman 

You’ll need Postman with the Multilogin API collection imported:

1. Install Postman
2. Open the Multilogin API documentation and click “Run in Postman”
3. Click “Import”

How to sign in through the API

Use API sign-in only when your integration needs to log in without someone copying a token from the Multilogin dashboard. For regular automation, use an automation token instead. It lasts longer and doesn't need to be refreshed every 30 minutes.

Step 1: generate your MD5 password hash

The “User Sign In” request needs an MD5 hash of your Multilogin password, not the password itself.

You can generate it on your computer using Python 3. Make sure Python is installed before starting. On Windows, use py instead of python3 if needed.

1. Open Terminal (macOS/Linux) or PowerShell (Windows)
2. Run this command:

python3 -c "import hashlib, getpass; print(hashlib.md5(getpass.getpass('Password: ').encode()).hexdigest())"

3. Enter your Multilogin password when prompted
4. Copy the generated hash

Step 2: sign in and get your tokens

Use your email and password hash to sign in through the API. You'll get a regular API token for making requests and a refresh token for renewing access.

1. In Postman, open “Profile Access Management” → “User Sign In”
2. Go to “Body” and enter your email and password hash

{
  "email": "[email protected]",
  "password": "your_md5_password_hash"
}

3. Click “Send”

A successful sign-in returns two values:

• token: your regular API token, valid for 30 minutes
• refresh_token: lets you get another regular API token without signing in again

Keep both values private. You'll need them for the next step.

How to refresh your regular API token

Regular API tokens expire after 30 minutes. Use “User Refresh Token (Switch Workspace)” to get new tokens without signing in again.

You'll need your regular API token in “Authorization” and your refresh token in “Body”.

1. In Postman, open “Profile Access Management” → “User Refresh Token (Switch Workspace)”
2. Open “Authorization”
3. Select “Bearer Token”
4. Enter the token returned by “User Sign In”
5. Open “Body” and enter your email and refresh token

{
  "email": "[email protected]",
  "refresh_token": "your_refresh_token"
}

6. Click “Send”

A successful response returns a new token and refresh_token. Use the new values for future requests.

FAQs

Why am I getting "Missing authorization header"?

The refresh request needs your regular API token under “Authorization” → “Bearer Token”.

Make sure you've added the regular token, not the refresh_token. The refresh token belongs in the JSON body.

Why am I getting "Wrong workspace user"?

Check the workspace_id in your request.

• If you're refreshing a token for your current workspace, remove workspace_id from the body unless strict mode requires it
• If you're switching workspaces, use a real workspace ID that your account has access to

Don't leave Postman's example value <string> in the request.

Can I use this method to refresh an automation token?

No. The refresh request works with regular API tokens, not automation tokens.

If your automation token expires, generate a new one.

Why does Postman return “Wrong JWT token”?

Your API token may have expired or might be missing from the authorization settings. Get a fresh token and add it under “Authorization” → “Bearer Token”. Make sure the token belongs to the correct Multilogin workspace.

How long does my API token last?

A regular API token lasts 30 minutes. For longer-running or repeated API requests, we recommend using an automation token instead.