Airwallex Spend and Issuing vs Spendesk API + MCP

Airwallex Spend and Issuing

Scoped API keys split read from write per resource, tokens last 30 minutes, and the sandbox opens at once with no contract. No OpenAPI spec was found, every Spend endpoint read is marked beta, the pricing page lists direct Spend API integration under the custom-priced Accelerate plan, and no SLA was found.

Spendesk API + MCP

Scoped credentials, MCP write permissions that are off by default, an action log and published guidance on prompt injection suit delegated finance work. Access needs a paying customer and a request to Spendesk, most write endpoints are experimental, no official SDK was found, and the status page lists three critical incidents between 2 and 29 September 2026.

Airwallex Spend and Issuing

1. Exchange x-client-id and x-api-key at POST /api/v1/authentication/login once, then reuse the bearer token for 30 minutes. The login endpoint allows 100 requests a minute per key
2. Create Spend keys with organisation-level permissions. With a key linked to several accounts, send x-login-as at login or the token carries no account permissions
3. Send a fresh UUID as request_id on every create call and reuse the same value when retrying after a timeout
4. Expect two pagination styles. Spend and card transaction events use the page bookmark with page_after and page_before. Cards and legacy transactions use page_num and has_more
5. Card and expense lists default to the last 30 days. Pass both created-at bounds to read further back, and fetch a card singly to see its authorization_controls

Spendesk API + MCP

1. Request a token at POST /v1/auth/token with HTTP Basic (client ID and secret). It lasts 3,600 seconds, so renew on a 401
2. Stop paging at the last page calculated from total and pageSize (maximum 30). A page past the end returns 404, not an empty list
3. With an organisation-level token, send X-Company-Id on every v1 call or expect a 400
4. The MCP server refuses API keys. Connect with OAuth authorisation code and PKCE, and treat Tool not found (-32601) as a missing permission
5. After an unclear write result, read the object again before retrying. Creating a purchase order or supplier twice creates two