Full Control Over Your API Access
app-airwallex gives developers granular, environment-scoped API key management — with full audit logs, role-based access, and zero-downtime key rotation. Ship with confidence across sandbox and production, without ever exposing a single credential.
sk_live_4xK9...mP2qJan 15, 2025sk_live_8nL2...vR7wFeb 03, 2025sk_live_2cT6...jF1kMar 22, 2025Audit Log
243 events tracked
Enterprise-grade controls
for every key.
From isolation to audit trails, app-airwallex gives your security and engineering teams full control over API credential lifecycle.
Environment Separation
Sandbox and production keys kept strictly isolated.
Every app-airwallex account maintains two fully independent key namespaces. Sandbox keys hit our mock payment rails — real validation logic, zero real money movement. Production keys are scoped to live infrastructure. The two environments share no credentials, no data, and no blast radius.
Sandbox
sk_test_••••••••••••4f2a
Production
sk_live_••••••••••••9c1d
Cross-environment requests are rejected at the network edge. No exceptions.
Isolation Status
Fully Isolated
| Resource | Read | Write | Admin |
|---|---|---|---|
| Transactions | |||
| FX Rates | |||
| Payouts | |||
| Webhooks | |||
| API Keys | |||
| Team Members | |||
| Audit Logs |
Click a scope tab above to see what it unlocks.
Scoped Permissions
Assign read, write, or admin scopes per key with a visual permission matrix.
Apply least-privilege to every integration. A data warehouse connector needs read only. A payout service needs write. Your internal dashboard needs admin. Grant exactly what is required — nothing more.
Read
Write
Admin
Key Rotation & Revocation
Rotate keys without downtime using a dual-key grace period window.
Routine key rotation is a security fundamental — but it shouldn't cause outages. app-airwallex's dual-key handoff keeps both the old and new key live during a configurable grace window, giving your team time to propagate changes safely.
Rotation Timeline
Generate New Key
A new key is issued alongside the existing active key.
Grace Period Active
Both keys accept requests for up to 72 hours.
Update Your Services
Deploy the new key across your infrastructure.
Revoke Old Key
The original key is permanently invalidated. Zero downtime achieved.
Showing 5 of 6 entries · Retained for 90 days
Audit & Monitoring
Every API call logged with timestamp, IP, endpoint, and response code.
Complete observability over every interaction with your API keys. Filter by status code, export as CSV for your SIEM, or push events in real time via webhook. Full audit trails satisfy SOC 2, PCI-DSS, and enterprise procurement requirements.
CSV Export
Pipe into your SIEM or data warehouse
Webhook Push
Real-time delivery to your endpoint
90-Day Retention
Configurable to meet your compliance window
SOC 2 & PCI-DSS
Audit-ready for enterprise procurement
Security & Compliance Standards
app-airwallex maintains the most rigorous certifications in the payments industry, independently audited and continuously upheld.
PCI DSS Level 1
app-airwallex is certified at PCI DSS Level 1 — the highest tier of compliance for organizations that process over six million card transactions annually. This certification validates our end-to-end cardholder data environment, covering network security, access controls, vulnerability management, and continuous monitoring protocols.
Download ReportSOC 2 Type II
Our SOC 2 Type II attestation, issued by an independent AICPA-accredited auditor, demonstrates sustained operational controls across the Trust Services Criteria: Security, Availability, Processing Integrity, Confidentiality, and Privacy. Unlike a point-in-time snapshot, Type II covers a continuous observation period — giving enterprise customers verifiable assurance over time.
Download ReportISO 27001
Our Information Security Management System (ISMS) is certified to ISO/IEC 27001:2022 — the internationally recognised standard for systematic information security governance. Certification encompasses risk assessment, asset management, supplier relationships, incident response, and business continuity planning across all production systems and API infrastructure.
Download ReportAll API keys are stored encrypted at rest using AES-256 and transmitted over TLS 1.3.
Zero plaintext exposure — from key generation through rotation and revocation.
From Zero to Live
in Three API Calls
Create your key, authenticate requests, and handle rotation — everything you need to integrate app-airwallex into production.
Create a Key via POST /v1/api-keys
Issue a new API key by specifying a name, expiry window, and the exact permission scopes your integration requires.
POST /v1/api-keys HTTP/1.1Host: api.airwallex.comContent-Type: application/jsonAuthorization: Bearer <YOUR_ACCESS_TOKEN>{"name": "production-payments-key","expires_in": 7776000,"scopes": ["payments:read","payments:write","accounts:read","transfers:write","fx:read"]}// Response 201 Created{"id": "key_3f8d2c1a9b4e7f0d","name": "production-payments-key","prefix": "awk_live_3f8d","secret": "awk_live_3f8d2c1a9b4e7f0d6a3b8c5e2d9f1a4b","scopes": ["payments:read", "payments:write","accounts:read", "transfers:write", "fx:read"],"created_at": "2026-01-15T08:32:11Z","expires_at": "2026-04-15T08:32:11Z","status": "active"}
Ready to integrate?
Generate your first API key in the dashboard — no credit card required to start.
Global Payments Infrastructure, Powered by API. Move money across borders at the speed of code.
Developers
© 2026 app-airwallex. All rights reserved.