{"templateId":"markdown","sharedDataIds":{"sidebar":"sidebar-products/wallet/sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":["admonition"]},"type":"markdown"},"seo":{"title":"API credentials best practices","description":"User guides, API reference, and support resources.","siteUrl":"https://docs.ripple.com","lang":"en-US","llmstxt":{"hide":false,"sections":[{"title":"Table of contents","includeFiles":["**/*"],"excludeFiles":[]}],"excludeFiles":[]}},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"api-credentials-best-practices","__idx":0},"children":["API credentials best practices"]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"warning","name":"Important: please read carefully"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Given the sensitive nature of API credentials, adhering to strict best practices is crucial to preventing unauthorized access to your assets."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Follow these practices to securely use and store your API credentials with Ripple Custody (Wallet). For the procedures to create, disable, and delete credentials, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/wallet/organization-and-access/api-credentials/manage-api-credentials"},"children":["Manage API credentials"]},"."]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Limit credential permissions"]},": assign each set of credentials the least privilege necessary, following the ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"#principle-of-least-privilege"},"children":["principle of least privilege"]}," (PoLP)."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Implement IP allowlisting"]},": only allow requests from specified trusted IP addresses, rather than all IP addresses. This prevents access requests from unknown sources. See ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"#configure-ip-allowlisting"},"children":["Configure IP allowlisting"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Rotate credentials regularly"]},": delete old credentials and create new ones on a defined schedule (for example, quarterly) to limit the risk of a compromised ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["clientSecret"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Store the client secret securely"]},": Ripple Custody (Wallet) displays the client secret only once. Keep it in a secrets manager or secure vault."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Separate by environment"]},": use different credentials for sandbox and production. Never share credentials across environments."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Monitor credential usage"]},": use ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/wallet/integrations-and-monitoring/audit-logging"},"children":["audit logging"]}," to track which credentials are making API calls and when."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Require approval for new credentials"]},": set up an approval group for API credentials to prevent unauthorized creation. See ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/wallet/governance-and-controls/approvals/configure-approval-flows"},"children":["Configure approval flows"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Document credential ownership"]},": record which team or service owns each credential and who is responsible for rotating it."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Request tokens only from the token endpoint"]},": exchange credentials at ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["/v2/credentials/oauth/token"]}," whenever you need a token, and don't build your own token cache. See ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/wallet/organization-and-access/api-credentials/manage-api-credentials#use-api-credentials-via-the-api"},"children":["Use API credentials"]},"."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"principle-of-least-privilege","__idx":1},"children":["Principle of least privilege"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The principle of least privilege (PoLP) refers to creating API credentials with as little privilege, or scope, as possible. This practice limits permissions to only those necessary to complete the task at hand."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["When credentials are limited to specific scopes, even if they're compromised, the damage an attacker can inflict is constrained to the permissions assigned to those credentials. The PoLP therefore minimizes the exposure of sensitive operations and data to potential threats."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Using multiple sets of credentials for differing operation types, rather than relying on a single, highly privileged set of credentials, also compartmentalizes access and functionality. This compartmentalization:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Facilitates auditability"]},": having designated credentials for specific operation types makes it easier to trace and log actions."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Enhances operational security"]},": multiple credentials let organizations tailor access and permissions to the varied needs and risks of different operation types."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Apply the principle of least privilege to every credential:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Use the narrowest scope"]},": if a credential only needs access to one vault, set the scope to ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["vault"]}," and specify that vault as the resource. Avoid ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["org"]}," scope unless the credential genuinely needs organization-wide access."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Limit actions"]},": grant only the actions the integration needs. A monitoring service needs ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["read"]}," only, not ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["create"]}," or ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["delete"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Use one credential per integration"]},": create separate credentials for each service or application. This limits the blast radius if someone compromises a credential."]}]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info","name":"Scoping example"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["A transaction monitoring service needs to read transactions across all vaults but must not create or modify anything. Create a credential with the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Transactions"]}," permission set type, then remove any ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["create"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["update"]},", or ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["delete"]}," permissions. Keep only ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["read"]}," actions."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Applying the principle of least privilege through minimally scoped credentials, and using multiple credential sets for different operations, are vital strategies for enhancing security, managing risk, and maintaining the integrity of the system."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"configure-ip-allowlisting","__idx":2},"children":["Configure IP allowlisting"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["IP allowlisting restricts which network addresses can use a credential. You can configure up to 6 IP entries per credential. Each entry can be a single IPv4 address or a CIDR range."]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Sandbox"]},": use ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["All IP addresses"]}," for convenience during development."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Production"]},": always use ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Limited IP addresses"]}," with the specific IPs or CIDRs of your application servers. Never use ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["All IP addresses"]}," in production environments."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["You can't change a credential's IP address settings after you create it. To change them, create a new credential and delete the old one."]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info","name":"API documentation"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["See the ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/wallet/api-docs/palisade-api/palisade-api"},"children":["Ripple Custody (Wallet) API reference"]}," for more information about the Ripple Custody (Wallet) API."]}]}]},"headings":[{"value":"API credentials best practices","id":"api-credentials-best-practices","depth":1},{"value":"Principle of least privilege","id":"principle-of-least-privilege","depth":2},{"value":"Configure IP allowlisting","id":"configure-ip-allowlisting","depth":2}],"frontmatter":{"title":"API credentials best practices","seo":{"title":"API credentials best practices"}},"lastModified":"2026-10-09T11:09:54.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/products/wallet/organization-and-access/api-credentials/best-practices","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}