Welab Authentication

generated: '2026-08-05'
method: probed
source: https://api-sandbox.welab.bank/
docs: https://portal-sandbox.welab.bank/
note: >-
  Derived from live transport-layer probes of WeLab Bank's Open API gateways, not from a published
  specification — WeLab Bank publishes no anonymous OpenAPI, and its developer portal is registration-gated,
  so the application-layer credential model (token endpoints, scopes, header names) could not be observed.
  What IS observable and certain is that both gateways terminate TLS with a client-certificate request and
  refuse any request that does not present one.
summary:
  types:
  - mutualTLS
  api_key_in: []
  oauth2_flows: []
  registration: required
  registration_note: >-
    Access to the sandbox and to the API catalogue requires registration with WeLab Bank as a third-party
    service provider (TSP), consistent with the Hong Kong Monetary Authority Open API Framework, under which
    account-information APIs require a bank-onboarded TSP.
schemes:
- name: clientCertificate
  type: mutualTLS
  description: >-
    Both the production gateway (api.welab.bank) and the sandbox gateway (api-sandbox.welab.bank) require a
    client certificate at the TLS layer. The sandbox gateway completes the TLS 1.3 handshake, sends a
    CertificateRequest, and then answers an anonymous HTTP/2 request with 400 "No required SSL certificate
    was sent" (nginx). No path, method or payload is reachable without a WeLab-issued client certificate.
  sources:
  - probe:https://api-sandbox.welab.bank/
  hosts:
  - api.welab.bank
  - api-sandbox.welab.bank
x-evidence:
  checked: '2026-08-05'
  probes:
  - url: https://api-sandbox.welab.bank/
    http_status: 400
    server: nginx
    body: '400 No required SSL certificate was sent'
    tls: TLSv1.3
    tls_certificate_request: true
    cert_subject: CN=api-sandbox.welab.bank
    cert_issuer: C=US; O=Amazon; CN=Amazon RSA 2048 M01
  - url: https://api.welab.bank/
    http_status: 0
    note: TCP connect timeout after 8s from a US network; A record resolves to prod-opa-gw-public-nlb (AWS ap-east-1, Hong Kong)
  - url: https://portal-sandbox.welab.bank/
    http_status: 403
    note: Cloudflare "Attention Required" block page; the same 403 is returned to a browser user-agent and to WebFetch