…
Two-token auth · 22 endpoints · every one runnable in the browser

A2B Developer Playground

Reference and live request console for the A2B developer playground — the vendor and client halves of the marketplace API, driven by one credential pair.

Which token calls it

The API is split by side of the marketplace. Paste a token once and the console dims whichever half it cannot reach.

Your first request

Every playground call carries both headers. The bearer token is the secret — its four-character prefix (clt_ or vnd_) says which table to resolve it in, so the row it matches is the caller. The X-Api-Token is the identity half, so a bearer token lifted on its own is not enough.

Local
http://localhost:8081
Production
https://dashboard.a2bsample.com

No handler anywhere takes a client id or a vendor id: the caller's id always comes from the token, and a project id in a path is ownership-checked rather than trusted.

Request
# 1. Confirm who you are — the only call that does not need X-Api-Tokencurl --request GET \  --url 'https://dashboard.a2bsample.com/api/developer/me' \  --header "Authorization: Bearer $A2B_BEARER_TOKEN"​# 2. List your projects — both halves of the pair, every timecurl --request GET \  --url 'https://dashboard.a2bsample.com/api/developer/playground/client/projects?maxPerPage=5' \  --header "Authorization: Bearer $A2B_BEARER_TOKEN" \  --header "X-Api-Token: $A2B_API_TOKEN"