Authentication
Every QwikLive Lending API request is authenticated with client credentials and a partner identifier, passed as headers.
Required Headers
| Header | Required | Description |
|---|---|---|
X-Client-Id | Required | Your QwikLive client identifier. |
X-Client-Secret | Required | Your client secret. Treat it like a password — never log, embed in URLs, or expose it client-side. |
X-Partner | Required | Partner identifier issued to your organization. |
X-Correlation-Id | Optional | A client-generated trace id (UUID recommended). Echoed back on the response and useful when raising support tickets. |
Keep secrets server-side
Credentials must only ever be sent from your backend over TLS. Do not embed X-Client-Secret in mobile apps, browser code, or query strings. Rotate immediately if a secret is exposed.
Example
Headers
X-Client-Id: your-sandbox-client-id X-Client-Secret: **************** X-Partner: QWIKLIVE X-Correlation-Id: 7c3e1b90-2a44-4c8e-9b1a-0f5d2a6e8c10 Content-Type: application/json
Authentication Errors
| Status | Meaning |
|---|---|
401 | Missing or invalid client credentials. |
403 | Credentials are valid but not permitted for this operation or partner. |
429 | Rate limit exceeded — back off and retry after the indicated interval. |
All errors use the standard Problem envelope.