Access and environments

Trade API access is provisioned per environment. Start in sandbox, validate your integration with test Axiym accounts, registered external accounts, and balances, and request production access when your implementation is ready.

The partner credentials identify your partnership. Every Trade API business resource belongs to an onboarded client selected through /clients/{clientId}. Axiym provisions accounts, balances, permissions, and external-account test fixtures for the clients used in each environment.

What you provide

Give Axiym:

• the stable public egress IP addresses or CIDR ranges used by systems that call the API;
• the expected client operating model and test-client requirements; and
• the currencies and workflows you need to test.

If your hosting, NAT gateway, proxy, or outbound routing changes, update the allowlist before sending traffic from the new address.

What Axiym provides

For each environment, Axiym provides:

• the Trade API base URL;
• an OAuth client_id and client_secret with the TRADE scope;
• confirmation that your egress addresses are allowlisted; and
• access to the Axiym accounts and conversion pairs agreed for that environment.

In sandbox, Axiym also funds a sell-side test Axiym account with test balance so you can exercise the permitted conversion workflow. Sandbox balances have no monetary value and cannot be transferred to production.

Depending on the workflows included in your integration, Axiym also confirms the available bank-testing process, blockchain test networks, test assets, and registered external-account details. Do not use production payment details or real funds in sandbox.

Credentials, Axiym accounts, balances, registered external accounts, and other resources are not shared between sandbox and production.

Environment endpoints

Call the API by hostname. The destination IP is provided for partners whose outbound firewall policy also requires an IP allowlist.

Network allowlisting

Axiym accepts API requests only from allowlisted source addresses. A request from another address returns 403 Forbidden, even when its access token is otherwise valid.

Confirm the actual public egress address from every runtime that can call the API. Private container, pod, or virtual-machine addresses are not the source addresses Axiym sees when traffic passes through NAT.

Sandbox readiness checklist

Before using the quickstart, confirm that:

• sandbox credentials have been issued and stored securely;
• the calling system's sandbox egress address is allowlisted;
• at least two active Axiym accounts are available for a permitted conversion pair for the client you will test;
• the Axiym-funded account matching the pair's sell side has sufficient balance for the planned conversion; and
• the test client's clientId is available to the integration.

Continue with Sandbox testing, then Make your first conversion.

Production readiness checklist

Before requesting production activation:

• repeat network and credential setup using production-specific values;
• remove sandbox credentials and URLs from production configuration;
• verify timeout, retry, and idempotency behavior;
• verify that logs retain request IDs but never credentials or access tokens;
• test API lifecycle and reconciliation handling across deposits, conversions, and withdrawals;
• separately validate any production bank connectivity and operational processes that sandbox simulates; and
• confirm the production Axiym accounts, registered external accounts, and permitted conversion directions with Axiym.

Webhook delivery has separate network and signature requirements. Configure it from the Webhooks section after basic API access is working.