airvvaliex's REST API, webhooks, and fully featured sandbox give engineering teams everything they need to integrate cross-border payments, real-time FX, and card issuance — without the infrastructure overhead. Ship production-ready in your first sprint.
Four production-grade API modules, each independently versioned and documented — composable into any financial product you're building.
Send domestic and international payments programmatically. Trigger transfers in 40+ currencies with real-time status updates delivered via webhook — no manual reconciliation required.
Fetch real-time mid-market rates for 150+ currency pairs. Lock confirmed rates for up to 72 hours to protect transactions from volatility — ideal for quote-and-settle workflows.
Programmatically create, fund, freeze, and cancel virtual and physical cards for any cardholder. Define spending controls, limits, and merchant-category restrictions at the card level.
Create and manage multi-currency sub-accounts for your customers or subsidiaries. Each account gets its own ledger, balance view, and permission scope — fully isolated and auditable.
Ready to start integrating?
Generate your sandbox API key in under 60 seconds. No credit card required.
Official client libraries, a guided onboarding flow, and downloadable tooling — everything your team needs to go from zero to production-ready.
Official Client Libraries
Get Started in 3 Steps
Tooling & Specifications
Download our Postman collection or OpenAPI spec and start exploring the full airvvaliex API surface instantly.
Every layer of the airvvaliex API is designed with defense-in-depth. From token scoping and HMAC verification to network-level allowlisting, your integration is protected at every boundary.
Every airvvaliex API key is issued with an explicit permission scope. Read-only keys expose GET endpoints for data retrieval and reporting. Read-write keys additionally allow transaction creation, account management, and configuration updates. Admin keys carry full access including team management, webhook configuration, and billing operations — issue them only to trusted automation systems.
All API access is gated through OAuth 2.0 bearer tokens using the client credentials flow. Access tokens are short-lived (TTL: 3600 seconds) and scoped to the permissions granted at token creation. Refresh tokens enable seamless rotation without re-authentication. Pass your token in the Authorization header: Bearer <token>. No token is ever transmitted in query strings or request bodies.
Every webhook payload dispatched by airvvaliex is signed using HMAC-SHA256 with a shared secret unique to your endpoint. The computed signature is transmitted in the X-Airvvaliex-Signature-256 header. Validate it server-side by recomputing the HMAC over the raw request body using your webhook secret — reject any request where signatures do not match. Replayed requests are detectable via the included event timestamp.
Restrict API access to a predefined list of trusted IPv4 or IPv6 CIDR blocks from the airvvaliex dashboard. Requests originating outside the allowlist return HTTP 403 before any credential evaluation occurs. For CI/CD pipelines or cloud-hosted services, allowlist your egress IP ranges. Allowlists apply per API key and can be updated without regenerating credentials.
Limits apply per API key. HTTP 429 is returned when limits are exceeded, with a Retry-After header indicating reset time.
Rate Limit Response Headers
X-RateLimit-LimitMax requests allowed per windowX-RateLimit-RemainingRequests remaining in current windowX-RateLimit-ResetUnix timestamp when window resetsNeed higher limits or a custom security review?
Enterprise plans include dedicated rate pools, custom IP rules, and a named solutions engineer.
Global financial infrastructure built for modern business. Move money, manage risk, and scale without limits — across 150+ countries.
Phone
+1 888 247 8935Address
340 Pine Street, Suite 800
San Francisco, CA 94104, USA
© 2026 airvvaliex. All rights reserved.