Access and Environments

Values supplied during onboarding

Obtain these values from AECloud before development:

Value	Purpose
API base URL	Prefix for all versioned integration endpoints. It normally ends in /v1.
Token URL	OAuth2 endpoint used to request an access token.
Swagger URL	Interactive catalogue for the assigned environment.
Client ID	Public identifier for the merchant API client.
Client secret	Confidential value used only when requesting a token.
Company code	Merchant GUID placed in aec.companyCode and relevant status or void requests.
Outlet names	Exact AECloud outlet names accepted for the merchant.
Environment rules	Sandbox data restrictions, production approval, and any IP or operational controls.

Examples in this guide use:

{api_base_url}
{token_url}
{client_id}
{client_secret}
{company_code}

Do not type the braces when replacing a placeholder.

These values authorize the merchant's downstream system to call AECloud. They are not MyInvois taxpayer or intermediary credentials. AECloud manages its separate connection to MyInvois, subject to the merchant's onboarding, configuration, and required taxpayer permission.

Merchant readiness

Before the first document is uploaded, verify that the merchant:

• is active and subscribed;
• has an active subscription end date;
• has sufficient licensed outlets;
• has complete LHDN configuration;
• has an API client credential; and
• has confirmed the default individual and consolidated submission settings.

The API can create a previously unknown outlet during upload, but only while the merchant remains below the subscribed outlet limit. For controlled production operation, create and verify outlet names in advance. Otherwise, a spelling variation can consume an additional outlet entitlement.

Sandbox and production separation

Treat sandbox and production as separate systems:

• use different credentials;
• keep different base and token URLs;
• do not copy production personal data into sandbox;
• use clearly identifiable test document numbers;
• verify configuration independently; and
• never allow a test deployment to select production by default.

Store environment selection in protected deployment configuration, not inside source code.

API version

All endpoints in this guide are below the /v1 base path. Call:

GET {api_base_url}/version/

as a connectivity and version check. A successful version check confirms the API host is reachable and the token is accepted; it does not confirm that merchant configuration is ready for document submission.

Swagger API

The authenticated AECloud Swagger API displays the live endpoint catalogue for its environment. Use it to confirm paths, methods, and basic parameter placement. For submission endpoints, send the AECloud JSON object directly as the raw request body. A generated schema may describe the raw body binding as body_text; do not send a JSON property named body_text around the document.