To get token please use forms mentioned in New authorization way. For processing under token token/login is used. Command signature is as follows:

svc=token/login&params={"token":<text>,
                        "operateAs":<text>,
                        "fl":<uint>}

- create new token (token/update command, callmode:create);
- execute token/list command (if tokens already created).

After login session is created, you can execute some requests within it. If server haven't received any requests for 5 minutes the session will be killed. To prevent such behaviour you can send a request every 5 minutes, for example requests/avl_evts.

{
	"eid":<text>,			/* session ID */
	"gis_sid":<text>,		/* session ID for gis services */
	"host":<text>,			/* host */
	"hw_gw_ip":<text>,		/* hardware gateway ip */
	"au":<text>,			/* user name */
	"pi":<int>,			/* ping interval */
	"tm":<uint>,			/* current time (UTC) */
        "wsdk_version":<text>           /* sdk version */
	"user":{			/* user from whose behalf you want to perform login */
		"nm":<text>,			/* name  */
		"cls":<uint>,			/* ID of superclass "user" */
		"id":<long>,			/* ID */
		"prp":{				/* custom properties, for example: */
			"dst":<text>,			/* daylight savings time */
			"language":<text>,		/* language (two-lettered code) */
			"msakey":<text>,		/* access key to mobile site */
			"pcal":<text>,			/* Iranian calendar */
			"tz":<text>,			/* time zone */
			"us_units":<text>,		/* US metrics (miles and gallons) */
			...				
		},
		"crt":<uint>,			/* creator ID */
		"bact":<uint>,			/* account ID */
		"fl":<uint>,			/* user flags */
		"hm":<text>,			/* host mask */
		"uacl":<uint>,			/* user access to himself */
		"mu": <uint>,			/* Measurement system */
		"ct": <uint>,			/* User creation date */
		"ftp": {<text>},		/* FTP settings */
		"ld": <uint>,			/* Last login date */
		"pfl": <uint>,			/* Creators flag */
		"ap": {				/* Two-factor authentication settings */
		    "type":<uint>,		/* authentication type ( 0 - none, 1 - email, 2 - SMS ) */
		    "phone":<text>		/* Phone number */
		},    
		"mapps": {<text>},		/* Mobile apps list */
		"mappsmax": <int>		/* Restrictions on mobile applications specified in the billing plan */
	},
	"classes":{			/* superclasses available for current user (key - superclass name, value - superclass ID): */
		"avl_hw":<uint>,		/* hardware type */
		"avl_resource":<uint>,		/* resource */
		"avl_retranslator":<uint>,	/* retranslator */
		"avl_unit":<uint>,		/* unit */
		"avl_unit_group":<uint>,	/* unit group */
		"user":<uint>,			/* user */
		"avl_route":<uint>		/* route */
	}
	"features":{
		"unlim":<bool>,			/* billing plan type: 0 - regular, 1 - special (for development/testing) */
		"svcs":{			/* hash-collection of allwed services, if service not mentioned here means it is forbidden */
			"<service_name>":<bool>,	/* key - service name, value: 0 - service available, but limit reached, 1 - service available and can be used */
			...
		}
	}
 
	...,		/* core/login response */
 
	"token":"{\"app\":\"<text>\",\"ct\":<uint>\"at\":<uint>,\"dur\":<uint>,\"fl\":<uint>\"p\":\"<text>\",\"items\":[<long>]}",	
								/* all token settings as escaped json */
	...		/* core/login response */
}

Clarification for <service_name>: for additional info please refer to services list.

User flags are described in the chapter Set user settings flags.

More about FTP setting here - Custom FTP settings.