Allwallex API ยท v1
Authentication.
Account sessions and merchant API credentials have different responsibilities.
Testnet environment. Transactions use test assets and do not settle real payments.
01Email and passkeys
One-time codes expire after ten minutes. Sensitive permissions require verified passkeys.
02API keys
Server keys use Authorization: Bearer with an aw_test_ token. Wallets, checkout, ledger reads and internal transfers have separate scopes. transfers:create additionally requires an explicitly approved wallet and debit-limit policy issued with recent passkey verification. A bearer key cannot manage credentials, grant admin access or call session-based withdrawal endpoints.
03Operator access
Operator sessions are separate from user sessions and require recent passkey verification.