# API credentials overview

To interact with the Wallet-as-a-Service (Palisade) API, you need API credentials, which you create and manage in the console.

## What are API credentials?

API credentials are unique secrets that authenticate and authorize access to resources and actions in the system.

You can grant each credential permissions to access specific resources and perform deliberate actions. It gives you fine-grained control over who can interact with the API and what each credential can do.

## How do API credentials secure access to the API?

When you create a credential, Wallet-as-a-Service (Palisade) generates a `clientId` and `clientSecret`. These act as a username and password: you exchange them for an access token and a refresh token using the OAuth flow. The access token authenticates your API requests. The refresh token allows you to get more access tokens.

## Credential types

Each API credential has a type that scopes it to a category of API resources and actions. A credential can't call endpoints outside its type, so create a separate credential for each category your integration uses.

| Type | Grants access to |
|  --- | --- |
| **WALLETS** | Vaults, wallets, balances, and tags |
| **TRANSACTIONS** | Creating and managing transactions — transfers, raw signing, XRP Ledger transaction types, fee estimation, freezing and unfreezing — and triggering sweeps |
| **CONTROLS** | Counterparties, address book entries, and policy rules |
| **MONITORING** | Webhooks and webhook subscriptions |


For example, an integration that reads balances and creates transfers needs two credentials: one of type **WALLETS** and one of type **TRANSACTIONS**.

MONITORING appears as AUDIT in the API
The console labels the fourth type **MONITORING**, but API responses return its category as `AUDIT`. They're the same credential type.

## What requires the console

Not everything is available through API credentials. Administrative and security-sensitive domains — devices, MPC quorums, users and roles, approvals, organization settings, API credential management, WalletConnect connections, and sweep configuration — are managed in the Wallet-as-a-Service (Palisade) console and authenticated by your console session. API credentials can trigger a configured sweep, but creating or changing sweep configurations happens in the console.