Authentication - Arltech Finance API

Overview

Every /finance/ endpoint requires a JWT token sent in the x-access-token request header. Each environment has its own auth endpoint and issues independent tokens.

Production
UAT

Base URL: https://api.arltechgroup.com

Get a token

curl -X POST https://api.arltechgroup.com/api/auth/signin \
  -H "Content-Type: application/json" \
  -d '{"username": "your_username", "password": "your_password"}'

Response

{
  "id": 1,
  "username": "your_username",
  "accessToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
}

Use the token

curl https://api.arltechgroup.com/finance/customers \
  -H "x-access-token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."

Production credentials are live. All operations affect real customer accounts and devices.

Base URL: https://developer-uat.arltechgroup.com

Get a token

curl -X POST https://developer-uat.arltechgroup.com/api/auth/signin \
  -H "Content-Type: application/json" \
  -d '{"username": "your_uat_username", "password": "your_uat_password"}'

Response

{
  "id": 1,
  "username": "your_uat_username",
  "accessToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
}

Use the token

curl https://developer-uat.arltechgroup.com/finance/customers \
  -H "x-access-token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."

UAT is a sandbox environment. Test all integration flows here before switching to Production credentials.

Token expiry

Tokens are valid for 24 hours on both environments. After expiry you will receive:

{ "message": "Unauthorized! Access Token was expired!" }

Re-authenticate against the same environment to get a fresh token.

Never expose your token in client-side code or commit it to version control. Store it in environment variables or a secrets manager.

​Overview

​Get a token

​Use the token

​Get a token

​Use the token

​Token expiry

Overview

Get a token

Use the token

Get a token

Use the token

Token expiry