API Access Token
Airwallex uses an API key and Client ID to authenticate requests. You authenticate by exchanging your API key and Client ID for a short-lived access token, then sending that token as Authorization: Bearer <token> on every subsequent call. The access token is valid for 30 minutes and can be reused until it expires. Do not call the authentication endpoint before each request. Track expiration using the expires_at field from the login response. To get an access token, call Obtain an access token.
You can view and manage API keys in the Airwallex web app. Do not share your API key in publicly accessible places such as GitHub repositories, client-side code, and so forth. For guidance on scoping, storing, and rotating your keys, see API key best practicesDocs.
Airwallex authorizes each request against the scopes attached to your API key. For the full catalog of key permissions, see API key scopesDocs.
All requests must be made over HTTPS. Only PCI-DSS recommended TLS versions and cipher suitesDocs are supported.
POST /api/v1/authentication/login
Obtain Access Token
POST /api/v1/authentication/login
Obtain an access token by specifying your x-client-id and x-api-key in the HTTP request header. Include the access token you receive in the Authorization: Bearer [token] header when calling other endpoints. The access token remains valid for 30 minutes and can be reused until it expires. Always refer to the expires_at field for the exact expiration time.
If your scoped API key includes permissions for multiple accounts, include the x-login-as header to specify the target account that the returned access token is authorized for. If the scoped API key also includes organization-level permissions, the access token would automatically have access to organization-level resources. For more details, see Manage API keysDocs.
API key provided by Airwallex.
Client unique identifier provided by Airwallex.
Account unique identifier to be used for authentication.
Token expiration time in ISO8601 format.
Authentication token returned.
| Error status | Description |
|---|---|
| 400 | Bad request. Data provided is either incomplete or malformed. |
| 401 | Possible errors: |
| 403 | Forbidden. The request was denied due to insufficient permissions |
| 429 | Too many requests |
| 500 | Service unavailable |
$curl --request POST \> --url 'https://api.sandbox.airwallex.com/api/v1/authentication/login' \> --header 'x-api-key: <string>' \> --header 'x-client-id: <string>'
1{2 "token": "eyJhbGciOiJSUzI1NiJ9.eyJpYXQiOjE2MjQwMDAwMDAsImV4cCI6MTYyNDAwMTgwMH0.example",3 "expires_at": "2021-06-18T16:30:00+0000"4}