Loader API
The Loader API is a general-purpose JWT signing service. You send it a set of claims (key/value pairs) and an API key, and it returns a signed JWT that you can use with downstream services that trust the AccessPayHub issuer.
Tokens are signed with RSA-2048 (RS256) and are valid for 60 minutes. The endpoint adds three standard claims for you (jti, iat, exp); everything else in the token comes from what you send in claims.
Base URL
Production
https://group.pay.accessacloud.com/loader
Authentication
All API requests require authentication using an API key. Request one from the platform team — keys are issued per consumer and can be rotated on request.
X-Api-Key: {API_KEY}
Treat API keys as secrets. Don't commit them to source control, paste them into chat, or include them in screenshots. If a key leaks, ask the platform team to rotate it.
Endpoints
Create Token
1 item
Error Handling
All endpoints return errors in a consistent JSON format. When an error occurs, the API returns an appropriate HTTP status code along with an error response body.
Error Response Structure
{
"error": "Claims are required."
}
HTTP Status Codes
| Status Code | Description |
|---|---|
200 OK | Request successful |
400 Bad Request | The request body is missing, malformed, or claims is empty |
401 Unauthorized | The X-Api-Key header is missing or doesn't match a configured key |
503 Service Unavailable | The server has no API keys configured — server-side misconfiguration, not a client error |
What to do on failure
| Status | Action |
|---|---|
400 | Fix the request and retry |
401 | Don't retry with the same key — check the key and header. Repeated bad-key attempts are logged |
503 | Don't hammer the server — wait and contact the platform team |