---
updatedAt: 2026-10-16T12:59:06.000Z
agentTools:
  projectIndex: https://docs.infiniaweb.com/llms.txt
---

# 🔐 Authentication

Authenticate API requests with HTTP Basic authentication and act on behalf of your child companies.

Infinia uses HTTP Basic authentication. Every request includes an `Authorization` header built from your `secretId` and `secretPassword`, which your Infinia integration contact provides.

This page shows how to authenticate a request, which environment each set of credentials works in, and how to act on behalf of a child company.

## Authenticate a request

The header holds the word `Basic` followed by the Base64 encoding of `secretId:secretPassword`:

```text
Authorization: Basic <base64(secretId:secretPassword)>
```

Most HTTP clients build this header for you. With `curl`, pass the credentials with `-u`. The examples in these docs read them from the `API_KEY_USER` and `API_KEY_PASSWORD` environment variables:

```bash
curl -u "$API_KEY_USER:$API_KEY_PASSWORD" \
  "https://app2test.infiniaweb.com/infinia_api/v1/payments/"
```

<Callout icon="🔒" theme="warning">
  Keep your credentials private. Don't put them in client-side code, version control or public repositories. If you suspect they have been compromised, contact Infinia right away to rotate them.
</Callout>

## Environments

| Environment | Base URL                                      |
| :---------- | :-------------------------------------------- |
| Sandbox     | `https://app2test.infiniaweb.com/infinia_api` |
| Production  | Provided with your production credentials     |

Each API adds its version and path to the base URL, for example `/v1/payments` for payins and `/v2/payouts` for payouts.

Sandbox and production credentials are separate. Credentials issued for one environment don't work in the other.

## Act on behalf of a child company

If your company has child companies, you can call the API on their behalf. Add the `X-Company-Id` header with the child company's ID. You keep using your own credentials, and only the scope of the request changes.

```bash
curl -u "$API_KEY_USER:$API_KEY_PASSWORD" \
  -H "X-Company-Id: 57" \
  "https://app2test.infiniaweb.com/infinia_api/v1/payments/"
```

You can act on behalf of any company below yours in the hierarchy, whether it's a direct child or a descendant further down. If the ID belongs to any other company, the API rejects the request with a `401`.

## Authentication errors

| Status | Cause                                                                                   |
| :----- | :-------------------------------------------------------------------------------------- |
| `401`  | The credentials are missing or invalid, or `X-Company-Id` is not a company below yours. |
| `403`  | The API key is read-only and the request isn't a `GET`.                                 |
| `403`  | The API key has an IP allowlist and the request comes from an address that isn't on it. |