Authentication - Bambu Wallet API Docs

All Brand API requests require a Bearer access token. Use the same flow for every endpoint in the API Reference playground: obtain a token first, then call Brand API paths with Authorization: Bearer YOUR_ACCESS_TOKEN.

OAuth2 client credentials

Request a token with POST and Content-Type: application/x-www-form-urlencoded:

curl -X POST "https://api-auth.bambumeta.software/oauth2/token" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=client_credentials" \
  -d "client_id=YOUR_CLIENT_ID" \
  -d "client_secret=YOUR_CLIENT_SECRET" \
  -d "scope=https://admin.bambumeta.software/ui"

For sandbox, use https://api-auth-sandbox.bambumeta.software/oauth2/token.

Response

{
  "access_token": "eyJ...",
  "expires_in": 3600,
  "token_type": "Bearer"
}

Calling the Brand API

Include the token on every request:

curl "https://api.bambumeta.software/brands/YOUR_BRAND_ID/programs/YOUR_PROGRAM_ID/wallets?unique_id=1001" \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN"

Token lifetime

Tokens expire. When you receive 401 Unauthorized, request a new token. Do not embed long-lived tokens in client-side code.

Security

Store client_secret only on your server.
Never commit secrets to source control or share them in support channels.
Rotate credentials if a secret is exposed.

API Reference playground

In the API Reference tab, each endpoint uses this OAuth scheme (cognito-authorizer). Mintlify does not call the token URL for you. Paste a token from the curl example above into the playground Authorization field, or configure your client to refresh tokens before they expire.

​OAuth2 client credentials

​Response

​Calling the Brand API

​Token lifetime

​Security

​API Reference playground