# Access and environments

Product: Direct Trade API
Guides follow API reference 0.1.0 and event reference 0.1.0.
Canonical page: https://docs.axiym.io/direct-trade-api/integration-guide/access-setup

Direct Trade API access is provisioned per environment. Start in sandbox, validate
your integration with test Axiym accounts, address book entries, and
balances, and request production access when your implementation is ready.

The credentials identify your organization. Every Direct Trade API business
resource belongs to it, including when an operation supports a service you
provide to a client. The API does not create a separate `clientId` or resource
context for each customer. Axiym provisions accounts, balances, permissions,
and external-account test fixtures for your organization in each environment.

## What you provide

Give Axiym:

* the stable public egress IP addresses or CIDR ranges used by systems that
  call the API;
* the currencies and workflows you need to test.

If your hosting, NAT gateway, proxy, or outbound routing changes, update the
allowlist before sending traffic from the new address.

## What Axiym provides

For each environment, Axiym provides:

* the Direct Trade API base URL;
* an OAuth `client_id` and `client_secret` with the `TRADE` scope;
* confirmation that your egress addresses are allowlisted; and
* access to the Axiym accounts and conversion pairs agreed for that
  environment.

In sandbox, Axiym also funds a sell-side test Axiym account with test balance
so you can exercise the permitted conversion workflow. Sandbox balances have
no monetary value and cannot be transferred to production.

Depending on the workflows included in your integration, Axiym also confirms
the available bank-testing process, blockchain test networks, test assets, and
address book entry details. Do not use production payment details or
real funds in sandbox.

Credentials, Axiym accounts, balances, address book entries, and other
resources are not shared between sandbox and production.

## Environment endpoints

| Environment | Base URL                                      | API destination IP |
| ----------- | --------------------------------------------- | ------------------ |
| Sandbox     | `https://partner-api.sandbox.axiym.io/api/v1` | `35.244.214.3`     |
| Production  | `https://partner-api.axiym.io/api/v1`         | `34.160.126.192`   |

Call the API by hostname. The destination IP is provided for partners whose
outbound firewall policy also requires an IP allowlist.

## Network allowlisting

Axiym accepts API requests only from allowlisted source addresses. A request
from another address returns `403 Forbidden`, even when its access token is
otherwise valid.

Confirm the actual public egress address from every runtime that can call the
API. Private container, pod, or virtual-machine addresses are not the source
addresses Axiym sees when traffic passes through NAT.

## Sandbox readiness checklist

Before using the quickstart, confirm that:

* sandbox credentials have been issued and stored securely;
* the calling system's sandbox egress address is allowlisted;
* at least two active Axiym accounts are available for a permitted conversion
  pair; and
* the Axiym-funded account matching the pair's sell side has sufficient
  balance for the planned conversion.

Continue with [Sandbox testing](/direct-trade-api/integration-guide/sandbox-testing),
then [Make your first conversion](/direct-trade-api/integration-guide/quick-start).

## Production readiness checklist

Before requesting production activation:

* repeat network and credential setup using production-specific values;
* remove sandbox credentials and URLs from production configuration;
* verify timeout, retry, and idempotency behavior;
* verify that logs retain request IDs but never credentials or access tokens;
* test API lifecycle and reconciliation handling across deposits, conversions,
  and withdrawals;
* separately validate any production bank connectivity and operational
  processes that sandbox simulates; and
* confirm the production Axiym accounts, address book entries, and
  permitted conversion directions with Axiym.

Webhook delivery has separate network and signature requirements. Configure
it from the **Webhooks** section after basic API access is working.