Authentication

Every call (except login) must carry a token. There are two kinds of tokens, and you use them the same way.

	Login token (JWT)	Wallet token
Obtained with	POST/auth/login	POST/wallets/tokens
Tied to	a user (and their role)	your wallet
Expires	yes (see below)	never, unless you set expiresAt
Revoke by	changing the password	DELETE/wallets/tokens/{id}
Use it for	testing, one-off scripts	server integrations

Tokens are specific to each environment: a test token doesn't work in production.

🔑

No account? Request access — it's instant

No developer account yet? Get access to the test environment, instantly and for free.

Test developer access

Get an API token for the test environment right away, plus a link to sign in to the developer space.

Instant test API token, free, no credit card.

• Test API token sent by e-mail right away
• Sign-in to the developer space (AI assistant, roadmap)
• Every pass type enabled
• Free, no credit card

☕LOYALTY CARD

Café Lumière

Points

1 250

Tier

Gold

⚠️Test environment: emails and text messages are really sent. Use your own addresses or dummy ones.

Send the token

Authorization: Bearer <token>

The API also accepts the x-access-token: <token> header and the ?access_token=<token> query parameter. If several are present, the order of precedence is access_token, then x-access-token, then Authorization.

Avoid ?access_token=

A token in the URL ends up in proxy and server logs. Use the Authorization header.

Login token

Log in

POST/auth/loginTry it →

• curl
• SDK Node.js
• nodejs
• php
• python
• java
• csharp
• go
• ruby

• CURL

curl -L 'https://api-v2.test.eldowallet.fr/auth/login' \
-H 'Accept: application/json' \
-H 'Content-Type: application/json' \
-H 'x-lang: en' \
-H 'Authorization: Bearer <token>' \
-d '{
  "username": "your-username",
  "password": "your-password"
}'

The response contains the token: {"token": "eyJhbGciOi..."}.

• The login token expires. There is no refresh token: once the token has expired, the API returns 401:UNAUTHORIZED and you log in again.
• The token contains your role and the pass types enabled for your wallet. A call to a type that isn't enabled (for example /transits without the Transit option) returns 403:FORBIDDEN.

For a server integration, don't rely on the login token's expiry: use a wallet token.

Wallet tokens

For a server integration, create a dedicated token, store it in your secrets vault, and rotate it regularly.

Create a wallet token

POST/wallets/tokensTry it →

• curl
• SDK Node.js
• nodejs
• php
• python
• java
• csharp
• go
• ruby

• CURL

curl -L 'https://api-v2.test.eldowallet.fr/wallets/tokens' \
-H 'Accept: application/json' \
-H 'Content-Type: application/json' \
-H 'x-lang: en' \
-H 'Authorization: Bearer <token>' \
-d '{
  "expiresAt": "2027-06-30T00:00:00.000Z"
}'

{
  "_id": "6650f1c2a9e4b5d1c3a7e921",
  "token": "3f9c…e1a7",
  "tokenable": "6650a0b1c2d3e4f5a6b7c8d9",
  "tokenableType": "WALLET",
  "expiresAt": "2027-06-30T00:00:00.000Z"
}

• Without expiresAt, the token never expires.
• List your tokens with GET/wallets/tokens and revoke one with DELETE/wallets/tokens/{id}.

Authentication errors

Code	When
401:UNAUTHORIZED	Missing, invalid or expired token, or wrong password
403:FORBIDDEN	Valid token, but insufficient role or pass type not enabled

See all errors.