Everything you need to manage Airwallex API credentials — from understanding the differences between Sandbox and Production environments, to comparing API key types and permission scopes, to implementing secure key rotation and revocation workflows. This reference covers the full API key lifecycle so your integrations stay secure and compliant.
A complete reference for every credential type in the Airwallex platform — including scope boundaries, expiry rules, and exact dashboard locations. Click any column header to sort.
| Key Type | Environment | Permission Scope | Expiry Behavior | Dashboard Location |
|---|---|---|---|---|
Client IDPublic | SandboxProduction | Identifies your application. Used to initiate OAuth 2.0 flows and generate access tokens. No sensitive operations permitted. | Non-expiring. Persists until manually deleted or application is removed. | Developer → API Keys → Application Credentials |
API Key / SecretSecret | SandboxProduction | Full programmatic access: payments, payouts, accounts, FX, transfers, and reporting endpoints. Must be kept server-side only. | Non-expiring by default. Rotation recommended every 90 days. Revocable on demand. | Developer → API Keys → Secret Key (revealed once at creation) |
Access TokenToken | SandboxProduction | Scoped to the permissions granted at token issuance. Used in Authorization: Bearer headers for all API calls. | Expires after 30 minutes. Obtain a new token using your Client ID + API Key via /authentication/login. | Generated programmatically — not stored in dashboard. Returned by POST /authentication/login. |
Webhook SecretWebhook | SandboxProduction | Used exclusively to verify the x-signature header on incoming webhook events. Cannot authenticate API calls. | Non-expiring until webhook endpoint is deleted or secret is regenerated manually. | Developer → Webhooks → Endpoint Details → Signing Secret |
Sandbox Client IDSandbox | Sandbox | Identical scope to production Client ID but restricted to sandbox.airwallex.com base URL. Test flows only. | Non-expiring within sandbox environment. Separate from production credentials. | Developer (Sandbox mode) → API Keys → Application Credentials |
Sandbox API KeySandbox | Sandbox | Full sandbox API access with no real-money movement. Ideal for CI/CD pipelines and integration testing. | Non-expiring. Rotation available independently of production keys. | Developer (Sandbox mode) → API Keys → Secret Key |
Permission Scope
Identifies your application. Used to initiate OAuth 2.0 flows and generate access tokens. No sensitive operations permitted.
Expiry Behavior
Non-expiring. Persists until manually deleted or application is removed.
Dashboard Location
Developer → API Keys → Application CredentialsPermission Scope
Full programmatic access: payments, payouts, accounts, FX, transfers, and reporting endpoints. Must be kept server-side only.
Expiry Behavior
Non-expiring by default. Rotation recommended every 90 days. Revocable on demand.
Dashboard Location
Developer → API Keys → Secret Key (revealed once at creation)Permission Scope
Scoped to the permissions granted at token issuance. Used in Authorization: Bearer headers for all API calls.
Expiry Behavior
Expires after 30 minutes. Obtain a new token using your Client ID + API Key via /authentication/login.
Dashboard Location
Generated programmatically — not stored in dashboard. Returned by POST /authentication/login.Permission Scope
Used exclusively to verify the x-signature header on incoming webhook events. Cannot authenticate API calls.
Expiry Behavior
Non-expiring until webhook endpoint is deleted or secret is regenerated manually.
Dashboard Location
Developer → Webhooks → Endpoint Details → Signing SecretPermission Scope
Identical scope to production Client ID but restricted to sandbox.airwallex.com base URL. Test flows only.
Expiry Behavior
Non-expiring within sandbox environment. Separate from production credentials.
Dashboard Location
Developer (Sandbox mode) → API Keys → Application CredentialsPermission Scope
Full sandbox API access with no real-money movement. Ideal for CI/CD pipelines and integration testing.
Expiry Behavior
Non-expiring. Rotation available independently of production keys.
Dashboard Location
Developer (Sandbox mode) → API Keys → Secret KeySecurity Best Practice
Never expose your API Key / Secret or Webhook Secret in client-side code, public repositories, or logs. Store them as encrypted environment variables and rotate every 90 days. Access Tokens are short-lived by design — do not cache them beyond their 30-minute window.
Follow this four-step protocol to safely rotate your Airwallex API keys. The process keeps all services live throughout the transition — old and new keys are valid simultaneously until you explicitly revoke the old one.
⚠ Revocation Is Permanent and Irreversible
Once an API key is revoked, it cannot be restored or reactivated. Any service still using the old key will immediately begin receiving HTTP 401 Unauthorized responses. Do not revoke the old key until you have verified 100{833e3f7964deabbf1b06d1919aa9353b033df3c5a7cd6022b0b7c605e36be6e1} of your integrations are using the new key. Airwallex does not offer a grace period or recovery option after revocation.
Log in to the Airwallex dashboard and navigate to Developer → API Keys. Click 'Create API Key', assign the same scopes as the existing key, and give it a descriptive name with a rotation date suffix (e.g., payments-key-2025-07). Copy and securely store the new key immediately — it will only be shown once.
POST /api/v1/accounts/{account_id}/api_keys
Content-Type: application/json
Authorization: Bearer <your-oauth-token>
{
"name": "payments-key-2025-07",
"scopes": ["payment:read", "payment:write"],
"expiry_in_days": 90
}Tick every item before revoking the old key. Do not skip any.
Complete all 10 checklist items before revoking.
This action is irreversible. Ensure monitoring dashboards show zero errors first.
Your complete guide to Airwallex API key management — helping developers and finance teams navigate authentication, security, and integration with confidence.
Affiliation Disclaimer: aiwrallex-login is an independent educational resource and is not affiliated with, endorsed by, or officially connected to Airwallex Pty Ltd or any of its subsidiaries. All trademarks, service marks, and company names referenced on this site are the property of their respective owners. This website provides informational guides only and does not constitute financial, legal, or technical advice. Always refer to the official Airwallex documentation and support channels for authoritative guidance.
© 2026 aiwrallex-login. All rights reserved.
Independent guide — not affiliated with Airwallex Pty Ltd.