Configure API Credentials

Most API endpoints require authentication with a Client ID and Secret. Each Client ID has a specific set of allowed scopes (Permissions) to access API endpoints. Scopes allowed on an API client are accessed through the Dashboard Admin > API Management section. To add or remove a scope from an existing API credential, you must create new API credentials.

Contact your Entity Manager if you need permissions to manage API credentials.

When setting scopes, Paxos recommends following the principle of least privilege and only allow scopes required by a specific application. Scopes for each endpoint are listed in the Authorizations section in the API Reference docs. The Market Data and most Pricing endpoints do not require authorization. Once the credentials are activated, most users find success using one of the libraries on the OAuth2 website for authentication.

To add or modify API Credentials, you’ll need a Developer or other role with appropriate permissions. Contact your Entity Manager for help.

Add API Credentials

The API Management page listing saved API credentials, with the API Credential button in the top right

Click API Credential.
Enter a Nickname for your API credentials.
Select the Scopes for your Client ID. For example, the following scopes (space delimited) should be adequate to convert Paxos-issued stablecoins:

orchestration:read_orchestration
orchestration:write_orchestration
orchestration:read_orchestration_rule
orchestration:write_orchestration_rule
funding:read_profile
funding:write_profile
transfer:read_deposit_address
transfer:read_transfer
transfer:read_fiat_account
transfer:read_fiat_deposit_instructions
transfer:write_internal_transfer
transfer:write_crypto_withdrawal
transfer:write_deposit_address
transfer:write_fiat_account
transfer:write_fiat_deposit_instructions
transfer:write_fiat_withdrawal

Optional: Add Allowable IPs. If you have a single IP address, you can configure a CIDR entry to specify a single IP with 32 fixed bits by appending /32 to the address. For example, using 000.000.0.000/32 will allow only the IP address 000.000.0.000.

Organization Administrators can also configure an organization-wide IP restriction that applies to all credentials. See Organization Settings.

The Create API Credential form with a nickname, selected read and write scopes, and an allowable IP entry

Optional: Enable Request Signing.
Optional: Adjust Advanced Settings (Token Endpoint Auth Method, Grant Types, Redirect URIs). Leave these at their defaults unless a specific integration requires otherwise — see Advanced Settings.
Click Save API Credential. If your organization has an approval policy for API credentials, the button reads Submit for Approval and the credentials are not active until an approver approves the request.
Copy the Client ID and Client Secret and store them in a safe place. The secret will not be displayed in the UI again, and it will have to be reset if forgotten.

The API Details window showing the client scopes, Client ID, and a Client Secret with a warning that the secret is not shown again

Advanced Settings

Most credentials don’t need these — leave them at their defaults. Change them only when a specific integration requires it, such as SCIM or another third-party OAuth integration.

Setting	Default	When to change
Token Endpoint Auth Method	`client_secret_post` — the Client ID and Secret are sent in the request body.	Only if your integration requires a different client authentication method.
Grant Types	`Client Credentials` — the credential authenticates as itself.	Enable Authorization Code and Refresh Token for integrations that authorize on a user’s behalf and need long-lived refresh tokens (for example, SCIM).
Redirect URIs	None.	Required for the Authorization Code flow — add the integration’s exact callback URL. Refer to that integration’s setup guide for its value (for example, the SCIM Identity Provider guide for your IdP). The authorization request fails with `redirect_uri does not match` if the URL isn’t listed here.

Update or Delete Credentials

To make changes to an existing client, click View next to it in the credentials list, then click Edit or Delete.

Overview

Get Started

Money Movement

Fund Management

Administration

Identity Management

Rewards Engine

Notifications

Resources

Add API Credentials

Advanced Settings

Update or Delete Credentials

​Add API Credentials

​Advanced Settings

​Update or Delete Credentials

Add API Credentials

Advanced Settings

Update or Delete Credentials