Authentication

Overview

Wilow uses two layers of authentication:

Layer	What it identifies	How to pass it
API Key	Your partner integration	`API-KEY: ep_...` header
Customer Token	The logged-in customer	`Authorization: Bearer {token}` header

Your API key is fixed and scoped to your integration. The customer token is obtained per user and must be refreshed if the user re-links.

Reach out to info@wilow.app to get your API-KEY before you can start hitting the APIs.

Call Link Customer with the user’s details. The response returns an auth_token — store it and use it for all subsequent customer-scoped requests.

{
  "data": {
    "auth_token": "4055|5TJnGse60PlKk8PSmxHXz3HjgbaDAMvv5Z5mrGSF...",
    "customer_id": 961
  }
}

All POST requests require an Idempotency-Key header. Use a unique UUID per request to safely retry without duplicating operations.

Idempotency-Key: 550e8400-e29b-41d4-a716-446655440000