Most secured API endpoints require X-Client-Id, X-Client-Secret, and X-Client-Domain headers. These identify the client, authenticate the secret, and let XWMS verify that the request is coming from an allowed domain configuration.
powered by xwms
XWMS resolves the client and domain from the request headers, verifies that the client secret is active, checks that the domain is allowed, and enforces domain settings such as active status, authentication access, API access, server IP allowlists, and test or live mode rules.
Live support
Start a conversation
You must be logged in to start a support ticket.
Log inWelcome back. Start a ticket or leave your question.
