Woolworths Group Authentication

generated: '2026-10-22'
method: searched
source: https://developerhub.wpay.com.au/giftingservices/docs/jwt-authentication-process
docs: https://developerhub.wpay.com.au/giftingservices/docs/jwt-authentication-process
summary:
  types:
  - apiKey
  - http
  - signed-request
  api_key_in:
  - header
  note: Wpay publishes a different auth scheme per product. Only the two gifting specs declare securitySchemes; the Cards Connect, Connextor in-store and PayTo specs declare none, so their schemes below
    come from the docs.
schemes:
- name: X-Api-Key
  type: apiKey
  in: header
  parameter: X-Api-Key
  applies_to: Wpay Gift Card Partner API
  description: Partner integration key. Wpay issues a test-environment key at onboarding and a production key after certification, and adds the partner's production IP addresses to an allow list before
    go-live.
  sources:
  - openapi/woolworths-group-wpay-gift-card-partner-openapi.yml
  - https://developerhub.wpay.com.au/giftingservices/docs/becoming-a-gifting-partner
- name: bearerAuth
  type: http
  scheme: bearer
  bearerFormat: JWT
  applies_to: Wpay Gifting Client API
  description: The client generates an ES256 (prime256v1) key pair and gives Wpay its public key, Key ID and IPs to whitelist. In return Wpay issues an apiClientId, which goes in the JWT payload. A JWS
    is sent in the headers of every request.
  sources:
  - openapi/woolworths-group-wpay-gifting-client-openapi.yml
  - https://developerhub.wpay.com.au/giftingservices/docs/jwt-authentication-process
- name: cards-connect-jws
  type: http
  scheme: JWS (signed request)
  applies_to: Wpay Cards Connect (card-not-present) API
  description: The client generates two private/public key pairs in JWK format (Sandbox and Production) and shares the public keys. Every request carries a unique JWT signed into a JWS with method, path,
    query and sha256 claims, and the server checks those claims against the request (errors AUTH01-AUTH21). Credentials can be rotated by API (PUT /api/v1/keys/credential/rotate-to/{keyId}); a new credential's
    expiration cannot be more than 365 days in the future.
  sources:
  - https://developerhub.wpay.com.au/cardsconnect/docs/authentication
  - https://developerhub.wpay.com.au/cardsconnect/docs/credential-rotation
  - https://developerhub.wpay.com.au/cardsconnect/docs/error-codes
- name: connextor-http-hmac
  type: http
  scheme: wpay-http-hmac (HMAC-SHA256)
  applies_to: Wpay Cards Connect in-store (Connextor) API
  description: Requests are signed with X-Authorization (wpay-http-hmac id/nonce/version/headers/signature, version connextor-1.0), X-Authorization-Timestamp (rejected if it differs from server time by
    more than 900 seconds) and X-Authorization-Content-SHA256. The server signs responses with X-Server-Authorization-HMAC-SHA256.
  parameters:
  - X-Authorization
  - X-Authorization-Timestamp
  - X-Authorization-Content-SHA256
  sources:
  - openapi/woolworths-group-wpay-payment-openapi.yml
  - openapi/_original/wpay-developerhub/cardsconnect__overview-of-headers.md
  - openapi/_original/wpay-developerhub/cardsconnect__generating-the-client-request-header-and-signature.md
- name: payto-jws
  type: http
  scheme: JWS
  header: 'Authorization: JWS <JWStoken>'
  applies_to: Wpay NPP PayTo Merchant API
  description: The merchant is onboarded with a merchantId GUID, provides a public key and receives a Key ID (kid). Each request is signed as an ES256 JWS whose payload holds method, path, query, sha256
    (of the body), iat and exp; exp must be within 60 seconds of iat.
  sources:
  - https://developerhub.wpay.com.au/payto/docs/getting-connected
  - https://developerhub.wpay.com.au/payto/docs/signing-api-requests
docs_pages:
- https://developerhub.wpay.com.au/giftingservices/docs/jwt-authentication-process
- https://developerhub.wpay.com.au/giftingservices/docs/becoming-a-gifting-partner
- https://developerhub.wpay.com.au/cardsconnect/docs/authentication
- https://developerhub.wpay.com.au/cardsconnect/docs/credential-rotation
- https://developerhub.wpay.com.au/cardsconnect/reference/overview-of-headers
- https://developerhub.wpay.com.au/payto/docs/getting-connected
- https://developerhub.wpay.com.au/payto/docs/signing-api-requests