Skip to content

API credentials let your systems interact with Wallet-as-a-Service (Palisade) programmatically. Every credential authenticates with OAuth 2.0 client credentials (this is the only supported flow) and is scoped with a permission set that defines exactly what it can do. As an owner or administrator, you create, scope, and manage credentials to control what each integration can access.

How API credentials work

Each API credential consists of a client ID and client secret. Your application exchanges these for a time-limited Bearer token (valid for 1 hour) that authenticates API requests.

Permission sets scope credentials and define exactly what the credential can do. Each permission has four components:

ComponentDescription
TypeThe resource category (for example, balances, key, vault)
ActionThe operation (create, delete, read, update)
ScopeHow broadly the permission applies (org, vault, key)
ResourceA specific vault or wallet (optional — leave blank for all resources in the scope)

Create API credentials

  1. Go to Settings > API credentials.
  2. Select Create credentials.
  3. Select a permission set type — this pre-populates a set of default permissions:
Permission set typeWhat it grants
WalletsManage wallets and vaults
TransactionsManage transactions
ControlsManage policies and addresses
MonitoringWebhooks and auditing
  1. Enter a name (5–50 characters). Choose a descriptive name that identifies the integration (for example, "Production - Transaction Service").
  2. Enter an optional description (5–50 characters).
  3. Configure IP addresses:
    • All IP addresses (0.0.0.0/0) — suitable for sandbox testing.
    • Limited IP addresses — enter up to 6 IPv4 addresses or CIDR ranges. Use this in production.
  4. Review the default permissions. Select Add another permission to add more, or Remove to delete one.
  5. Select Generate credentials.
  6. Copy the client ID and client secret.
Store the client secret securely

Palisade displays the client secret only once. Store it in a secrets manager or secure vault. If you lose it, you must delete the credential and create a new one.

Scope credentials with least privilege

Apply the principle of least privilege to every credential:

  • Use the narrowest scope — if a credential only needs access to one vault, set the scope to vault and specify that vault as the resource. Avoid org scope unless the credential genuinely needs organization-wide access.
  • Limit actions — grant only the actions the integration needs. A monitoring service needs read only, not create or delete.
  • One credential per integration — create separate credentials for each service or application. This limits the blast radius if someone compromises a credential.
Scoping example

A transaction monitoring service needs to read transactions across all vaults but must not create or modify anything. Create a credential with the Monitoring permission set type, then remove any create, update, or delete permissions. Keep only read actions.

Configure IP whitelisting

IP whitelisting restricts which network addresses can use a credential.

  • Sandbox — use All IP addresses for convenience during development.
  • Production — always use Limited IP addresses with the specific IPs or CIDRs of your application servers.

You can configure up to 6 IP entries per credential. Each entry can be a single IPv4 address or a CIDR range.

Disable a credential

Disabling a credential immediately prevents it from authenticating. Existing tokens issued by the credential continue to work until they expire (up to 1 hour).

Use disabling when:

  • You suspect credential compromise
  • A team member who managed the integration leaves
  • You need to temporarily pause an integration for maintenance
  1. Go to Settings > API credentials.
  2. Select the credential.
  3. Select Disable.

To re-enable, open the credential and select Enable.

Delete a credential

Deleting permanently removes the credential. Any integration using it stops working immediately after existing tokens expire.

  1. Go to Settings > API credentials.
  2. Select the credential.
  3. Select Delete.
  4. Confirm the deletion.

Best practices

  • Rotate credentials regularly — delete old credentials and create new ones on a defined schedule (for example, quarterly).
  • Monitor credential usage — use audit logging to track which credentials are making API calls and when.
  • Require approval for new credentials — set up an approval group for API credentials to prevent unauthorized creation. See Configure approval flows.
  • Use IP whitelisting in production — never use "All IP addresses" in production environments.
  • Separate by environment — use different credentials for sandbox and production. Never share credentials across environments.
  • Document credential ownership — record which team or service owns each credential and who is responsible for rotating it.

Configure approval flows

Configure webhooks