Access Setup

Access setup is completed before an organization can call the Account API. It covers approval, access to your Axiym accounts, whitelisted own account setup, credentials, network allowlisting, and webhook delivery.

What Axiym provides

For each environment, Axiym provides:

• the Account API base URL;
• OAuth client_id, client_secret, and scope;
• confirmation of accessible accounts;
• confirmation of approved whitelisted own accounts;
• confirmation that withdrawal webhook events are enabled;
• API allowlisting for your egress IPs or CIDR ranges;
• agreed sandbox account, whitelisted own account, withdrawal, and webhook test data.

Sandbox and production are separate environments. Each environment has its own base URL, credentials, allowlist, webhook subscriptions, and data.

Base URLs

The Axiym API inbound IP is the destination address for API traffic to Axiym. Organizations that restrict outbound traffic by destination IP can allowlist this address.

The Axiym webhook outbound IP is the source address Axiym uses when delivering webhook events to your receiver. Organizations that restrict inbound traffic to their webhook receiver can allowlist this address.

Network access

Account API access requires IP allowlisting. Give Axiym the stable egress IP addresses or CIDR ranges for every system that will call the API.

Requests from addresses that are not allowlisted receive 403 Forbidden. If hosting, NAT, or outbound routing changes, update the allowlist before moving traffic.

Webhook delivery is configured through the API after access is provisioned. If your webhook receiver restricts inbound traffic, allowlist the Axiym webhook outbound IPs for the relevant environment.

Before development

• Onboarding and API approval requirements are confirmed.
• Sandbox base URL and OAuth credentials have been issued.
• Your egress IPs or CIDR ranges are allowlisted for sandbox.
• Sandbox accounts and approved whitelisted own accounts are available.
• Withdrawal webhook events are agreed.
• Credentials are stored securely.

Before production

• Production API approval is complete.
• Production base URL and OAuth credentials have been issued.
• Your egress IPs or CIDR ranges are allowlisted for production.
• Production accounts and approved whitelisted own accounts are confirmed.
• Webhook receiver, signature verification, and retry handling have been tested.
• Withdrawal creation and reconciliation behavior have been tested in sandbox.

After onboarding, continue with the Quick Start Guide.