🔐 Authentication

Infinia uses HTTP Basic authentication. Every request includes an Authorization header built from your secretId and secretPassword, which your Infinia integration contact provides.

This page shows how to authenticate a request, which environment each set of credentials works in, and how to act on behalf of a child company.

Authenticate a request

The header holds the word Basic followed by the Base64 encoding of secretId:secretPassword:

Authorization: Basic <base64(secretId:secretPassword)>

Most HTTP clients build this header for you. With curl, pass the credentials with -u. The examples in these docs read them from the API_KEY_USER and API_KEY_PASSWORD environment variables:

curl -u "$API_KEY_USER:$API_KEY_PASSWORD" \
  "https://app2test.infiniaweb.com/infinia_api/v1/payments/"

Environments

Each API adds its version and path to the base URL, for example /v1/payments for payins and /v2/payouts for payouts.

Sandbox and production credentials are separate. Credentials issued for one environment don't work in the other.

Act on behalf of a child company

If your company has child companies, you can call the API on their behalf. Add the X-Company-Id header with the child company's ID. You keep using your own credentials, and only the scope of the request changes.

curl -u "$API_KEY_USER:$API_KEY_PASSWORD" \
  -H "X-Company-Id: 57" \
  "https://app2test.infiniaweb.com/infinia_api/v1/payments/"

You can act on behalf of any company below yours in the hierarchy, whether it's a direct child or a descendant further down. If the ID belongs to any other company, the API rejects the request with a 401.

Authentication errors