{"templateId":"markdown","sharedDataIds":{"sidebar":"sidebar-products/wallet/sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":["admonition"]},"type":"markdown"},"seo":{"title":"Manage API credentials","description":"User guides, API reference, and support resources.","siteUrl":"https://docs.ripple.com","lang":"en-US","llmstxt":{"hide":false,"sections":[{"title":"Table of contents","includeFiles":["**/*"],"excludeFiles":[]}],"excludeFiles":[]}},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"manage-api-credentials","__idx":0},"children":["Manage API credentials"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["API credentials let your systems interact with Ripple Custody (Wallet) programmatically. Every credential authenticates with ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["OAuth 2.0 client credentials"]}," and is ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["scoped with a permission set"]}," that defines exactly what it can do. As an owner or administrator, you create, scope, and manage credentials in the console to control what each integration can access."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For how credentials, credential types, and permissions work, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/wallet/organization-and-access/api-credentials"},"children":["API credentials overview"]},". For security recommendations, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/wallet/organization-and-access/api-credentials/best-practices"},"children":["API credentials best practices"]},"."]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"warning","name":"Important: please read carefully"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Given the sensitive nature of API credentials, adhering to strict best practices is crucial to preventing unauthorized access to your assets. Read ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/wallet/organization-and-access/api-credentials/best-practices"},"children":["API credentials best practices"]}," before you create credentials for production."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"api-credential-actions","__idx":1},"children":["API credential actions"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Action"},"children":["Action"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Console role"},"children":["Console role"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Console procedure"},"children":["Console procedure"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"API procedure"},"children":["API procedure"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Create a credential"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Owner, Administrator"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"#create-api-credentials-via-the-console"},"children":["Create API credentials"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["-"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Get an access token"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["-"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["-"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/wallet/get-started/use-the-api#step-2-authenticate"},"children":["Authenticate"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["View or edit a credential"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Owner, Administrator (Auditor can view)"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"#view-and-edit-credentials-via-the-console"},"children":["View and edit credentials"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["-"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Disable or enable a credential"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Owner, Administrator"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"#disable-a-credential-via-the-console"},"children":["Disable a credential"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["-"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Delete a credential"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Owner, Administrator"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"#delete-a-credential-via-the-console"},"children":["Delete a credential"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["-"]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Permissions:"]}," In the console, owners and administrators can create, update, enable, disable, and delete credentials, and owners, administrators, and auditors can view them. See ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/wallet/organization-and-access/users-and-roles#api-credentials"},"children":["User roles and permissions"]},". The token exchange needs an enabled credential of any type. See ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/wallet/api-docs/palisade-api/palisade-api/api-credentials/credentialservice_exchangecredential"},"children":["Client credentials exchange"]},"."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"create-api-credentials-via-the-console","__idx":2},"children":["Create API credentials via the console"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Go to ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Settings"]}," > ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["API credentials"]},"."]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Select ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Create credentials"]},"."]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Select a ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Permission set type"]},". This governs which permissions you can add to the credentials. Changing the set type after you add permissions resets them:"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Permission set type"},"children":["Permission set type"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"What it grants"},"children":["What it grants"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Wallets"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Manage wallets and vaults"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Transactions"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Manage transactions"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Controls"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Manage policies and addresses"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Monitoring"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Webhooks and auditing"]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["See ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/wallet/organization-and-access/api-credentials#credential-types"},"children":["Credential types"]}," for the full list of what each type covers."]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Enter a ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["name"]}," (5–50 characters). Choose a descriptive name that identifies the integration (for example, \"Production - Transaction Service\")."]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Enter an optional ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["description"]}," (5–50 characters) that makes the purpose of the credentials clear."]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Configure ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["IP addresses"]},":"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["All IP addresses"]}," (",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["0.0.0.0/0"]},"): suitable for sandbox testing."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Limited IP addresses"]},": enter up to 6 IPv4 addresses or CIDR ranges, separated by commas. Use this in production."]}]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Build the permissions. The form starts with one empty permission. For each permission, select a type, action, and scope, and for a ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["vault"]}," or ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["key"]}," scope, optionally select up to 5 resources. This is the most important part of the process, because it sets which actions the credentials can perform."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Select ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Add another permission"]}," to add more, or ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Remove"]}," to delete one. Following the ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/wallet/organization-and-access/api-credentials/best-practices#principle-of-least-privilege"},"children":["principle of least privilege"]},", limit the scope of individual credentials."]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Select ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Generate credentials"]},"."]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["In the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["API Credentials"]}," dialog, copy the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Client ID"]}," (",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["clientId"]},") and ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Client secret"]}," (",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["clientSecret"]},"), and then select ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Done"]},". You need both to authenticate your requests."]}]}]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info","name":"Example"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["To create credentials that can only read asset balances in a particular vault, select the following options:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Permission set type: wallets"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Permission type: balances"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Permission action: read"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Permission scope: vault"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Permission resource: the specific vault"]}]}]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"warning","name":"Store the client secret securely"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Ripple Custody (Wallet) displays the client secret only once. Store it in a secrets manager or secure vault. If you lose it, you must delete the credential and create a new one."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"img","attributes":{"src":"/assets/api-credentials-create-form.56cde00bbab0747a20633ee317bf644adab80879a0acb59defa1767e878769a7.9fccc40d.png","alt":"The top of the Create credentials form, with the Wallets, Transactions, Controls, and Monitoring permission set types"},"children":[]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"img","attributes":{"src":"/assets/api-credentials-permission-builder.179da4f8494f79a2e19732e865ceb9ee1f5b3be724ce699a5b6c759d49f2109e.9fccc40d.png","alt":"The permission builder on the Create credentials form, with balances, read, and org selected"},"children":[]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"use-api-credentials-via-the-api","__idx":3},"children":["Use API credentials via the API"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Make sure the credentials are enabled."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Credentials are enabled automatically when you create them."]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Exchange the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["clientId"]}," and ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["clientSecret"]}," for an access token."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["You do this with the OAuth client credentials flow through the API. See the ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/wallet/api-docs/palisade-api/palisade-api"},"children":["Ripple Custody (Wallet) API"]}," for details."]}]}]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"sh","header":{"controls":{"copy":{}}},"source":"curl --location 'https://api.palisade.co/v2/credentials/oauth/token' \\\n--header 'Content-Type: application/json' \\\n--data '{\n    \"clientId\": \"cIUkXkZBBx3zukqr6LJ3th2CVaYrgotH\",\n    \"clientSecret\": \"MXDAtUtaoU7WzuhbtY76DHTH_2lvqNg7FEMnUFAFRDVV0UUGGkkOwTJJrnTnywpF\"\n}'\n","lang":"sh"},"children":[]},{"$$mdtype":"Tag","name":"ol","attributes":{"start":3},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["You receive a response containing the access token and other details."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["expiresIn"]}," is the number of seconds until the token expires. ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["scope"]}," has the same value for every credential and doesn't list the credential's permissions, which Ripple Custody (Wallet) checks on the server for each request."]}]}]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"json","header":{"controls":{"copy":{}}},"source":"{\n    \"accessToken\": \"eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImxBMmpQWDd5NWZTR0tMWDFtMkpucyJ9.eyJodHRwczovL3BhbGlzYWRlLmNvIjp7ImRldmljZUlkIjpudWxsLCJvcmdhbml6YXRpb25JZCI6IjIxYzgxMzE5LTViODMtNDVmOS1iNjQ4LTQyMDU1MDg0YWYxNSIsInNpZ25hdHVyZVZlcmlmaWNhdGlvbktleSI6bnVsbCwidXNlcklkIjoiMWU0YzFmYmEtOGMzNy00OGY0LWJhZDgtNTg0ODY0OTBmMjQxIn0sImlzcyI6Imh0dHBzOi8vcGFsaXNhZGUtZGV2ZWxvcG1lbnQuZXUuYXV0aDAuY29tLyIsInN1YiI6ImNJVWtYa1pCQngzenVrcXI2TEozdGgyQ1ZhWXJnb3RIQGNsaWVudHMiLCJhdWQiOiJodHRwczovL2FwaS5wYWxpc2FkZS5jby8iLCJpYXQiOjE3MjI4ODk3MTIsImV4cCI6MTcyMjg5MzMxMiwic2NvcGUiOiJiYWxhbmNlczpyZWFkOm9yZzppZD0yMWM4MTMxOS01YjgzLTQ1ZjktYjY0OC00MjA1NTA4NGFmMTU6KiIsImd0eSI6ImNsaWVudC1jcmVkZW50aWFscyIsImF6cCI6ImNJVWtYa1pCQngzenVrcXI2TEozdGgyQ1ZhWXJnb3RIIiwicGVybWlzc2lvbnMiOlsiYmFsYW5jZXM6cmVhZDpvcmc6aWQ9MjFjODEzMTktNWI4My00NWY5LWI2NDgtNDIwNTUwODRhZjE1OioiXX0.AxTTxM2oLArtE6uRNJ1ADhMmrvwVfFQXu1vE5XZqpK64HuXwZB26R-25P4XpA9LX0QH7JTOpE9snNN7VYs4RVGXwNKeDRW0Zne7IkAVUwCAfhBkVxZ8Z_BZfNrTumGa-2R45XiQ2v-EfQZZV59q95eEz0f1ALWlc4XgVp_A5LPR25yys-H4sWPJJq5JUBdHtPVr7gUSkH7P3P4GSi3iZfcKaqijEwpJxN7Qmf7j2UFSC68-WeDxDXlIZIWkgCUz4lfPkYcz7oxpjRRGIej9eTtV9c5fCrkZcEaSOsSvqL3O2ubFqQm8hf6czfkOlyBmu7E2PJzImD1JJqpkB_qYfXg\",\n    \"scope\": \"credential:read:credential::*\",\n    \"expiresIn\": 60,\n    \"tokenType\": \"Bearer\"\n}\n","lang":"json"},"children":[]},{"$$mdtype":"Tag","name":"ol","attributes":{"start":4},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Use the access token to authenticate requests to the API."]}]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"sh","header":{"controls":{"copy":{}}},"source":"curl --location 'https://api.palisade.co/v2/balances' \\\n--header 'Authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImxBMmpQWDd5NWZTR0tMWDFtMkpucyJ9.eyJodHRwczovL3BhbGlzYWRlLmNvIjp7ImRldmljZUlkIjpudWxsLCJvcmdhbml6YXRpb25JZCI6IjIxYzgxMzE5LTViODMtNDVmOS1iNjQ4LTQyMDU1MDg0YWYxNSIsInNpZ25hdHVyZVZlcmlmaWNhdGlvbktleSI6bnVsbCwidXNlcklkIjoiMWU0YzFmYmEtOGMzNy00OGY0LWJhZDgtNTg0ODY0OTBmMjQxIn0sImlzcyI6Imh0dHBzOi8vcGFsaXNhZGUtZGV2ZWxvcG1lbnQuZXUuYXV0aDAuY29tLyIsInN1YiI6ImNJVWtYa1pCQngzenVrcXI2TEozdGgyQ1ZhWXJnb3RIQGNsaWVudHMiLCJhdWQiOiJodHRwczovL2FwaS5wYWxpc2FkZS5jby8iLCJpYXQiOjE3MjI4ODk3MTIsImV4cCI6MTcyMjg5MzMxMiwic2NvcGUiOiJiYWxhbmNlczpyZWFkOm9yZzppZD0yMWM4MTMxOS01YjgzLTQ1ZjktYjY0OC00MjA1NTA4NGFmMTU6KiIsImd0eSI6ImNsaWVudC1jcmVkZW50aWFscyIsImF6cCI6ImNJVWtYa1pCQngzenVrcXI2TEozdGgyQ1ZhWXJnb3RIIiwicGVybWlzc2lvbnMiOlsiYmFsYW5jZXM6cmVhZDpvcmc6aWQ9MjFjODEzMTktNWI4My00NWY5LWI2NDgtNDIwNTUwODRhZjE1OioiXX0.AxTTxM2oLArtE6uRNJ1ADhMmrvwVfFQXu1vE5XZqpK64HuXwZB26R-25P4XpA9LX0QH7JTOpE9snNN7VYs4RVGXwNKeDRW0Zne7IkAVUwCAfhBkVxZ8Z_BZfNrTumGa-2R45XiQ2v-EfQZZV59q95eEz0f1ALWlc4XgVp_A5LPR25yys-H4sWPJJq5JUBdHtPVr7gUSkH7P3P4GSi3iZfcKaqijEwpJxN7Qmf7j2UFSC68-WeDxDXlIZIWkgCUz4lfPkYcz7oxpjRRGIej9eTtV9c5fCrkZcEaSOsSvqL3O2ubFqQm8hf6czfkOlyBmu7E2PJzImD1JJqpkB_qYfXg'\n","lang":"sh"},"children":[]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"warning","name":"Request tokens only from the token endpoint"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Always exchange your credentials at ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["/v2/credentials/oauth/token"]},". Requesting tokens any other way uses a limited issuance quota and can cause authentication failures for your organization. The endpoint caches tokens on the server, so call it whenever you need a token and don't build your own cache. Tokens last 60 seconds in Production and 1 hour in Sandbox and Development. Request a new token when the current one expires."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"view-and-edit-credentials-via-the-console","__idx":4},"children":["View and edit credentials via the console"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["After you create API credentials, they're listed in a table on the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["API credentials"]}," page. To find a credential, use ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Search credentials"]},", or select ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Filters"]}," to narrow the list by category, status, active state, name, description, client ID, ID, or date created or updated. To manage a credential, select it, or open the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Actions"]}," menu (three dots) in its row."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Viewing a credential displays a summary that includes:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Name and status"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Description"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Type"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Client ID (",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["clientId"]},", but not ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["clientSecret"]},")"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["ID"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Permissions"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["IP addresses, if you limited the credential to specific addresses"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Activity: who created the credential, and when it was created and last updated"]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["To edit the credential, select ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Edit credentials"]}," on the summary, change the permissions, and then select ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Update credentials"]},". Only the permissions are editable. You can't edit the set type, name, description, or IP address settings."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"disable-a-credential-via-the-console","__idx":5},"children":["Disable a credential via the console"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Disabling a credential immediately prevents it from authenticating, and it stays disabled until you enable it again. Access tokens already issued to the credential continue to work until they expire (60 seconds in Production, up to 1 hour in Sandbox and Development)."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Disable a credential when:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["You suspect credential compromise."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["A team member who managed the integration leaves."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["You need to temporarily pause an integration for maintenance."]}]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Go to ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Settings"]}," > ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["API credentials"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Select the credential, or open the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Actions"]}," menu in its row."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Select ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Disable"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["In the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Disable credentials"]}," dialog, select ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Disable"]}," to confirm."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The change goes through your organization's API credentials approval group. If you don't have one, Ripple Custody (Wallet) approves it automatically, so the credential can show ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Approval pending"]}," briefly before it's disabled. See ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/wallet/governance-and-controls/approvals#what-approval-groups-govern"},"children":["Approvals"]},"."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["To re-enable a credential, open it or its ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Actions"]}," menu, select ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Enable"]},", and then confirm in the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Enable credentials"]}," dialog."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"delete-a-credential-via-the-console","__idx":6},"children":["Delete a credential via the console"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Deleting permanently removes the credential, and you can't recover it. Any integration that uses it stops working as soon as its existing tokens expire."]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Go to ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Settings"]}," > ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["API credentials"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Open the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Actions"]}," menu (three dots) in the credential's row."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Select ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Delete"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["In the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Delete credentials"]}," dialog, select ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Delete"]}," to confirm."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"related-topics","__idx":7},"children":["Related topics"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/wallet/organization-and-access/api-credentials"},"children":["API credentials overview"]},": Credential types, permissions, and what requires the console"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/wallet/organization-and-access/api-credentials/best-practices"},"children":["API credentials best practices"]},": Least privilege, IP allowlisting, rotation, and monitoring"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/wallet/get-started/use-the-api"},"children":["Use the API"]},": End-to-end API walkthrough"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/wallet/governance-and-controls/approvals/configure-approval-flows"},"children":["Configure approval flows"]},": Require approval for credential creation"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/wallet/api-docs/palisade-api/palisade-api"},"children":["Ripple Custody (Wallet) API reference"]}]}]}]},"headings":[{"value":"Manage API credentials","id":"manage-api-credentials","depth":1},{"value":"API credential actions","id":"api-credential-actions","depth":2},{"value":"Create API credentials via the console","id":"create-api-credentials-via-the-console","depth":2},{"value":"Use API credentials via the API","id":"use-api-credentials-via-the-api","depth":2},{"value":"View and edit credentials via the console","id":"view-and-edit-credentials-via-the-console","depth":2},{"value":"Disable a credential via the console","id":"disable-a-credential-via-the-console","depth":2},{"value":"Delete a credential via the console","id":"delete-a-credential-via-the-console","depth":2},{"value":"Related topics","id":"related-topics","depth":2}],"frontmatter":{"title":"Manage API credentials","seo":{"title":"Manage API credentials"}},"lastModified":"2026-10-09T11:09:54.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/products/wallet/organization-and-access/api-credentials/manage-api-credentials","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}