Authentication

All API requests must include your agency's API token. Tokens are issued by Flywire and should be kept confidential.

Using Your Token

Set the X-Authentication-Key header on every request:

X-Authentication-Key: YOUR_API_TOKEN

Example

curl

curl 'https://api-platform.demo.flywire.com/agents/v2/' \
  --header 'X-Authentication-Key: YOUR_API_TOKEN'

Python

import requests

headers = {"X-Authentication-Key": "YOUR_API_TOKEN"}
response = requests.get(
    "https://api-platform.demo.flywire.com/agents/v2/",
    headers=headers
)

Node.js

const response = await fetch(
  "https://api-platform.demo.flywire.com/agents/v2/",
  { headers: { "X-Authentication-Key": "YOUR_API_TOKEN" } }
);

Token Security

• Never expose your token in client-side code, public repositories, or logs
• Store it securely using environment variables or a secrets manager
• Rotate tokens if you suspect they have been compromised — contact Flywire support to issue a new token

DANGER

Your API token grants full access to your agency's payment and insurance operations. Treat it with the same care as a password.

Error Responses

Regular HTTP semantics apply. For instance, if your token is missing or invalid, the API returns:

• 401 Unauthorized — token is missing, expired, or invalid
• 403 Forbidden — token is valid but lacks permissions for the requested resource

Environments

Environment	Base URL	Use for
Demo	https://api-platform.demo.flywire.com/agents/v2/	Testing and development
Production	https://api-platform.flywire.com/agents/v2/	Live operations

Your token may differ between environments. Confirm with Flywire which tokens are valid for which environment.