{"templateId":"markdown","sharedDataIds":{"sidebar":"sidebar-products/wallet/sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":["admonition"]},"type":"markdown"},"seo":{"title":"API credentials overview","description":"User guides, API reference, and support resources.","siteUrl":"https://docs.ripple.com","lang":"en-US","llmstxt":{"hide":false,"sections":[{"title":"Table of contents","includeFiles":["**/*"],"excludeFiles":[]}],"excludeFiles":[]}},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"api-credentials-overview","__idx":0},"children":["API credentials overview"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["To interact with the Ripple Custody (Wallet) API, you need API credentials, which you create and manage in the console."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"what-are-api-credentials","__idx":1},"children":["What are API credentials?"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["API credentials are unique secrets that authenticate and authorize access to resources and actions in the system."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["You can grant each credential permissions to access specific resources and perform deliberate actions. It gives you fine-grained control over who can interact with the API and what each credential can do."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"how-do-api-credentials-secure-access-to-the-api","__idx":2},"children":["How do API credentials secure access to the API?"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["When you create a credential, Ripple Custody (Wallet) generates a ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["clientId"]}," and ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["clientSecret"]},". These act as a username and password: you exchange them for a time-limited Bearer access token using the OAuth 2.0 client credentials flow, which is the only supported flow. The access token authenticates your API requests. When it expires, exchange the credentials again for a new token."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Access tokens last 60 seconds in Production and 1 hour in Sandbox and Development. For the exchange procedure, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/wallet/organization-and-access/api-credentials/manage-api-credentials#use-api-credentials-via-the-api"},"children":["Use API credentials"]},"."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"permissions","__idx":3},"children":["Permissions"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Each credential is scoped with a permission set that defines exactly what it can do. Each permission has four components:"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Component"},"children":["Component"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Description"},"children":["Description"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Type"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The resource category (for example, ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["balances"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["key"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["vault"]},")"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Action"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The operation (",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["create"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["delete"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["read"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["update"]},")"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Scope"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["How broadly the permission applies (",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["org"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["vault"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["key"]},", or ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["counterparty"]}," for address book entries)"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Resource"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["A specific vault or wallet (optional; leave it blank for all resources in the scope)"]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"credential-types","__idx":4},"children":["Credential types"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Each API credential has a type (the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["permission set type"]}," in the console) that scopes it to a category of API resources and actions. A credential can't call endpoints outside its type: the request returns ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["403"]}," with reason ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["PAL000.002"]},". Create a separate credential for each category your integration uses."]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Type"},"children":["Type"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Grants access to"},"children":["Grants access to"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["WALLETS"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Vaults, wallets (including vault and wallet tags), and balances"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["TRANSACTIONS"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Creating and managing transactions — transfers, raw signing, XRP Ledger transaction types, fee estimation, freezing and unfreezing — and triggering sweeps"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["CONTROLS"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Counterparties, address book entries, and policy rules"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["MONITORING"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Webhooks and webhook subscriptions"]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For example, an integration that reads balances and creates transfers needs two credentials: one of type ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["WALLETS"]}," and one of type ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["TRANSACTIONS"]},"."]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info","name":"MONITORING appears as AUDIT in the API"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Create credentials"]}," form labels the fourth type ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Monitoring"]},", but the credentials list shows it as ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Audit"]},", and API responses return its category as ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["AUDIT"]},". They're the same credential type."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"what-requires-the-console","__idx":5},"children":["What requires the console"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Not everything is available through API credentials. Administrative and security-sensitive domains — devices, MPC quorums, users and roles, approvals, organization settings, API credential management, WalletConnect connections, and sweep configuration — are managed in the Ripple Custody (Wallet) console and authenticated by your console session. API credentials can trigger a configured sweep, but creating or changing sweep configurations happens in the console."]}]},"headings":[{"value":"API credentials overview","id":"api-credentials-overview","depth":1},{"value":"What are API credentials?","id":"what-are-api-credentials","depth":2},{"value":"How do API credentials secure access to the API?","id":"how-do-api-credentials-secure-access-to-the-api","depth":2},{"value":"Permissions","id":"permissions","depth":2},{"value":"Credential types","id":"credential-types","depth":2},{"value":"What requires the console","id":"what-requires-the-console","depth":2}],"frontmatter":{"title":"API credentials overview","seo":{"title":"API credentials overview"}},"lastModified":"2026-10-09T11:09:54.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/products/wallet/organization-and-access/api-credentials","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}