Sandbox & Testing
Airwallex Sandbox API Setup
Learn how to configure your sandbox environment and generate test API keys to safely develop and validate integrations before going live.
6 min read
Developer Guide · Airwallex API
How to Review & Manage Your Airwallex API Keys
A practical, step-by-step guide for developers and finance teams — covering how to locate, review, rotate, and secure your API credentials directly inside the Airwallex dashboard. Avoid outages, prevent unauthorized access, and stay in control of your integration.
3 Types
of API Keys covered
12 Steps
to locate & rotate keys
8 Errors
diagnosed & fixed
This is an independent documentation guide. Not affiliated with or endorsed by Airwallex Pty Ltd.
Core Concepts
What Are Airwallex API Keys?
Airwallex uses three distinct credential types to authenticate your application, secure your server communications, and validate event notifications. Understanding each one is foundational to a correct integration.
pk_live_...Public Key
Your public API key is safe to expose in client-side environments. It identifies your Airwallex account when initializing payment elements, hosted payment pages, or embedded UI components on the front end.
Used For
- Initializing Airwallex.js
- Rendering payment elements
- Client-side tokenization
- Hosted checkout pages
Where to Find It
Airwallex Portal → Settings → API Keys → Public KeyNever expose your Secret Key or Webhook Secret in client-side code, public repositories, or browser DevTools. Treat them like passwords — rotate immediately if compromised.
airwallex-integration.js
JS
1// Initialize Airwallex with your keys2import Airwallex from 'airwallex-payment-elements';4await Airwallex.init({5env: 'prod',6origin: window.location.origin,7});9// Server-side: create a payment intent10const intent = await airwallex.paymentIntents.create({11amount: 1000,12currency: 'USD',13merchant_order_id: 'order_abc123',14});16// Verify webhook signature17const isValid = verifySignature(18payload, sig, whsec19);
Node.jsProduction env
18 linespk_live_
Public Key
Client-safe
sk_live_
Secret Key
Server-only
whsec_
Webhook
Signature verification
Airwallex Portal Location
All three credentials are managed under Settings → Developers → API Keys in your Airwallex dashboard. Keys are scoped per environment (production vs. demo).
Step-by-Step Guide
Finding Your Airwallex API Keys
Follow these four steps to locate, review, and manage your API keys securely within the Airwallex developer portal.
1
2
3
4
Log In to the Airwallex Portal
Visit login.airwallex.com and sign in with your registered credentials. Make sure you have the appropriate account role — Admin or Developer — to access API settings. If you use SSO or two-factor authentication, complete those steps before proceeding.
Navigate to Developer → API Keys
From the left-hand sidebar, expand the Developer section and click API Keys. This menu is visible only to users with Developer or Admin permissions on the account. You'll land on the API Keys management page, listing all existing keys and their statuses.
Review Active Keys & Permissions
Each key is listed with its environment (Live or Demo), creation date, last-used timestamp, and assigned permission scopes. Carefully review which scopes each key holds — principle of least privilege means each key should only have access to what it strictly needs. Revoke or rename any keys that appear unused or unrecognised.
Copy or Regenerate as Needed
Use the Copy button to safely capture a key for use in your application or CI/CD environment. If you suspect a key has been compromised, click Regenerate immediately — the old key is invalidated and a new one is issued. Never paste keys directly into source code; use environment variables or a secrets manager instead.
1
Log In to the Airwallex Portal
Visit login.airwallex.com and sign in with your registered credentials. Make sure you have the appropriate account role — Admin or Developer — to access API settings. If you use SSO or two-factor authentication, complete those steps before proceeding.
2
Navigate to Developer → API Keys
From the left-hand sidebar, expand the Developer section and click API Keys. This menu is visible only to users with Developer or Admin permissions on the account. You'll land on the API Keys management page, listing all existing keys and their statuses.
3
Review Active Keys & Permissions
Each key is listed with its environment (Live or Demo), creation date, last-used timestamp, and assigned permission scopes. Carefully review which scopes each key holds — principle of least privilege means each key should only have access to what it strictly needs. Revoke or rename any keys that appear unused or unrecognised.
4
Copy or Regenerate as Needed
Use the Copy button to safely capture a key for use in your application or CI/CD environment. If you suspect a key has been compromised, click Regenerate immediately — the old key is invalidated and a new one is issued. Never paste keys directly into source code; use environment variables or a secrets manager instead.
Pro tip: Airwallex provides separate API keys for Demo and Live environments. Always test integrations in the Demo environment before switching to your Live key in production.
Security Essentials
API Key Security Best Practices
A leaked or mishandled Airwallex API key can expose your financial operations to fraud and unauthorized transactions. Follow these three critical security rules without exception.
CRITICAL
Never Expose Secret Keys in Client-Side Code
Your Airwallex API secret key must never appear in browser JavaScript, mobile app bundles, or public repositories. Once exposed, it cannot be recalled. Attackers scan GitHub, npm packages, and browser DevTools for leaked credentials — often within minutes of exposure.
- Audit your frontend code for hardcoded key strings
- Add .env files to .gitignore before first commit
- Use git-secrets or truffleHog to scan repos
HIGH PRIORITY
Rotate Keys Periodically & After Any Suspected Breach
API keys are long-lived credentials that accumulate risk over time. Establish a rotation schedule — quarterly at minimum — and treat any suspected compromise as an immediate rotation event. Airwallex lets you generate a new key and deprecate the old one without downtime if you plan transitions carefully.
- Set calendar reminders for 90-day rotation cycles
- Invalidate old keys only after confirming new key works
- Log key creation/deletion events for audit trails
BEST PRACTICE
Use Environment Variables & Secrets Managers
The gold standard for API key storage is injecting credentials via environment variables at runtime, backed by a dedicated secrets manager. Solutions like AWS Secrets Manager, HashiCorp Vault, or Doppler ensure your keys are encrypted at rest, access-controlled, and auditable — never sitting in plaintext config files.
- Load keys from process.env or equivalent at startup
- Restrict secrets manager access with least-privilege IAM
- Enable automatic secret versioning and rollback
Security incident? If you suspect your Airwallex API key has been compromised, invalidate it immediately via the Airwallex portal under Settings → API Keys, then audit your transaction logs for unauthorized activity. Contact Airwallex support to flag the incident formally.
Troubleshooting
Common API Key Errors & Fixes
The most frequent issues developers hit when working with Airwallex API keys — and exactly how to resolve each one.
A 401 Unauthorized response means the API request could not be authenticated. The most common causes are:
- Wrong credentials: Double-check that you're using the correct Client ID and API Key pair. These are environment-specific — a sandbox key will not work in production.
- Malformed Authorization header: Ensure your header reads exactly
Authorization: Bearer <access_token>, not the raw API key. - Expired access token: Airwallex access tokens expire after 30 minutes. Re-authenticate via the
/authentication/loginendpoint to get a fresh token.
Fix
Re-generate your access token before each session or implement token refresh logic in your integration layer. Log the exact error body — Airwallex returns descriptive code and message fields that pinpoint the issue.
Airwallex distinguishes between two credential types with different lifespans:
API Key (Client Secret)
Long-lived. Does not expire automatically but can be revoked from the Airwallex Dashboard under Settings → API Keys. If revoked, all tokens generated with it become invalid immediately.
Access Token (Bearer)
Short-lived — expires in 30 minutes. Must be refreshed by calling /authentication/login with your Client ID and API Key again.
Fix
Implement an automatic token refresh mechanism in your SDK layer. Cache the token with a timestamp and refresh proactively 2–3 minutes before expiry to avoid mid-request failures.
Yes. If you have configured an IP allowlist on your Airwallex API key, only requests originating from those whitelisted IP addresses will be accepted. Requests from any other IP return a 403 Forbidden or authentication failure.
- Your local machine's IP and your production server's IP are almost certainly different. Add your server's static egress IP to the allowlist.
- If you use a cloud provider (AWS, GCP, Azure), attach an Elastic IP / static NAT IP to your service and whitelist that address.
- CI/CD pipeline failures? Add your build runner's IP range or use a fixed egress proxy for API calls.
Where to update
Airwallex Dashboard → Settings → API Keys → Edit Key → IP Allowlist. Changes take effect within a few minutes.
A 403 Forbidden with an "insufficient permissions" message means the API key's permission scopes do not include access to the endpoint or resource you're calling.
Airwallex uses role-based scopes on API keys. Common scopes include:
r:paymentsw:paymentsr:accountsw:transfersr:fxw:issuing
- Check the error response body for the specific permission that's missing.
- Navigate to Dashboard → Settings → API Keys and edit the key to add the required scopes.
Security note
Apply the principle of least privilege — only grant the scopes your integration genuinely needs. Avoid creating keys with all permissions enabled.
Airwallex maintains completely separate environments with separate credentials and separate base URLs. A sandbox API key will never authenticate against the production API, and vice versa.
Sandbox
Base URL:
https://api-demo.airwallex.com
Keys obtained from Demo Dashboard. No real money moves.
Production
Base URL:
https://api.airwallex.com
Keys obtained from Live Dashboard. Real transactions processed.
- Ensure your environment variable names are distinct: e.g.
AIRWALLEX_SANDBOX_KEYandAIRWALLEX_PROD_KEY. - Use a config flag (
NODE_ENV,APP_ENV) to select the correct base URL and credential pair automatically at runtime.
Airwallex enforces rate limits per API key to ensure platform stability. Exceeding these limits returns a 429 Too Many Requests response.
- Inspect the
Retry-Afterresponse header — it tells you how many seconds to wait before retrying. - Implement exponential backoff with jitter: start at 1 second, double on each retry, add random jitter to avoid thundering herd.
- Batch operations where the API supports it, and cache frequently-read resources locally rather than polling repeatedly.
Need higher limits?
Contact Airwallex support to discuss increased rate limits for high-volume production integrations. Provide your Client ID and expected request volume.
Still stuck? Explore the full developer resource library.
Step-by-step guides, security checklists, and integration walkthroughs for Airwallex APIs.
Developer Knowledge Base
Latest Guides & Articles
In-depth technical guides to help you integrate, secure, and scale your Airwallex API implementation with confidence.
Authentication
Webhook Authentication with Airwallex
Understand how to verify Airwallex webhook signatures and securely process event payloads in your backend without exposing your API keys.
8 min read
Production Deployment
Migrating from Test to Production Keys
A step-by-step checklist for safely replacing your sandbox API keys with live production credentials and avoiding service disruptions during launch.
10 min read
Want the full technical reference?
Browse the complete API Key Guide for every setup scenario and security pattern.
Independent ResourceNot Affiliated with Airwallex
Disclaimer & Trust Notice
aiwrallex-login (aiwrallex-login.com) is an independent, third-party informational resource. This website is not affiliated with, endorsed by, sponsored by, or in any way officially connected to Airwallex Ltd. or any of its subsidiaries, partners, or related entities.
All guides, tutorials, and documentation published on this site are produced independently for educational and informational purposes only. They are intended to help developers and finance professionals understand how Airwallex API keys work, based on publicly available information. Content on this site does not constitute official Airwallex documentation and may not reflect the most current platform features, policies, or interface changes.
For authoritative, up-to-date guidance — including account management, compliance requirements, billing, and API specifications — always consult the official Airwallex website at airwallex.com and its official developer documentation portal.
Airwallex™ and related marks are trademarks of Airwallex Ltd. All product names and trademarks mentioned are the property of their respective owners.
Visit Official Siteaiwrallex-login
Your complete guide to Airwallex API key management — helping developers and finance teams navigate authentication, security, and integration with confidence.
- [email protected]
- +44 20 0000 0000
- 123 Fintech Way, London, EC2A 4NE, UK
Affiliation Disclaimer: aiwrallex-login is an independent educational resource and is not affiliated with, endorsed by, or officially connected to Airwallex Pty Ltd or any of its subsidiaries. All trademarks, service marks, and company names referenced on this site are the property of their respective owners. This website provides informational guides only and does not constitute financial, legal, or technical advice. Always refer to the official Airwallex documentation and support channels for authoritative guidance.
© 2026 aiwrallex-login. All rights reserved.
Independent guide — not affiliated with Airwallex Pty Ltd.