Authentication

Tenant ID — one identifier, several names

Your Tenant ID is the same value as your OAuth Client_ID — the identifier Axia assigned to your organization at setup (typically a UUID, e.g. 27c0767f-0abe-40ce-81d9-c168a71354b5). There is no separate "tenant id" to request: Client_ID is the tenant id.

The same identifier appears under different names across the API — they are all the same value:

Where it appears	Name used	Direction
OAuth credentials (Basic auth on token endpoints)	Client_ID	you → API
HTTP header on API calls	x-client-id	you → API
POST /v1/bank-accounts/create body	application	you → API
checkOnboarding / account responses	clientCode	API → you
Crypto/OTC/webhook payloads	clientId	API → you

Every /v1/* route except /v1/authentication/* requires the gateway to resolve your tenant on every request. The Bearer token alone is not always enough — tenant validation runs before the token's client is resolved. Rule of thumb: always send the x-client-id: <your Client_ID> header on every API call. Without it, requests fail with HTTP 400:

{
  "error": "MISSING_CLIENT_ID",
  "message": "Client ID (x-client-id) is required"
}

---

POST /v1/authentication/oauth/access-token

Request a Bearer token for API access.

Headers:

Header	Value
Authorization	Basic <Base64(Client_ID:Client_Secret)>

Request: No body required.

Example:

curl -X POST https://baas-gtw.axiadigitalsolutions.com/v1/authentication/oauth/access-token \
  -H "Authorization: Basic Y2xpZW50X2fdfdfdF9zZWNyZXQ="

Response 200 OK:

{
  "access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...",
  "token_type": "Bearer"
}

---

POST /v1/authentication/oauth/introspect

Validate/introspect a token to check if it is still active.

Headers:

Header	Value
Authorization	Basic <Base64(Client_ID:Client_Secret)>
token	Bearer token value to introspect

The token to introspect is read from the token request header, not from a query parameter or a second Authorization header. Sending it as ?token= fails with You must send the bearer token on header.

Example:

curl -X POST https://baas-gtw.axiadigitalsolutions.com/v1/authentication/oauth/introspect \
  -H "Authorization: Basic Y2xpZW50X2lkOmNsaWVudF9zZWNyZXQ=" \
  -H "token: eyJhbGci..."

Response 201 Created:

{
  "active": true,
  "client_id": "your-client-id",
  "token_type": "Bearer",
  "exp": 1710786400
}

---

POST /v1/authentication/oauth/revoke

Revoke a token and all linked grants.

Headers:

Header	Value
Authorization	Basic <Base64(Client_ID:Client_Secret)>
token	Bearer token value to revoke

The token to revoke is read from the token request header, not from a query parameter or a second Authorization header.

Example:

curl -X POST https://baas-gtw.axiadigitalsolutions.com/v1/authentication/oauth/revoke \
  -H "Authorization: Basic Y2xpZW50X2lkOmNsaWVudF9zZWNyZXQ=" \
  -H "token: eyJhbGci..."

Response 200 OK:

{
  "body": "Token revoked",
  "when": 1710786400000
}

---