Skip to main content

​
How access works

KeyStone API access is provisioned by the KeyStone team as part of partner onboarding. There is no self-serve signup. To get started, contact us - once your platform is approved, the KeyStone team creates your account and issues your credentials. During onboarding you receive:
  • A platform account registered against your organization
  • A Development environment connected to testnets (Sepolia and Base Sepolia), so you can build and test without real assets
  • M2M credentials for that environment: a client_id and a client_secret
  • An invitation email for your first dashboard admin user
Development environments use testnet smart contracts. No real tokens or funds are involved.

​
Your credentials

Each environment has its own machine-to-machine credential pair:
  • The client_id identifies your environment. It is visible any time via GET /v1/platforms/me/environments.
  • The client_secret is delivered to you once during onboarding, through a one-time secret link. KeyStone does not store your secret and cannot show it again - it can only be rotated.
Use these credentials to obtain access tokens for server-to-server API calls:
See Authentication for token handling, scopes, and SDK usage.
Keep your client_secret secure. Never expose it in frontend code, commit it to version control, or send it over email or chat. If a secret may have been exposed, rotate it immediately.

​
Rotating a secret

You can rotate an environment’s client_secret yourself via the API. Rotation requires the platform:security:manage scope and is scoped to your own environment: {environment_id} must be the environment your credential is bound to (dashboard user tokens select it with the X-Keystone-Environment header). Any other environment returns 404.
The response contains the new client_secret exactly once:
Store the new secret immediately - it cannot be retrieved again. Rotation propagates within about thirty seconds; during that window either the old or the new secret may be accepted, after which the old secret stops working. Access tokens that were already issued remain valid until they expire. A dashboard UI for credential management is planned. Until then, rotation is API-only, and the KeyStone team can also rotate a secret for you on request.

​
Additional environments

Additional environments (staging, production) are provisioned by the KeyStone team as part of your rollout. Each comes with its own client_id and one-time client_secret. Contact your onboarding contact when you are ready to move beyond Development.

​
Getting test tokens

To run settlements on testnets, you need test tokens. KeyStone provides two mintable ERC-20 tokens for development:
  • KBOND - A test security token representing a tokenized bond
  • TUSDC - A test stablecoin representing USDC
Both are available on Sepolia and Base Sepolia. See the testnet addresses page for contract addresses and minting instructions.

​
Support

For credential issues, environment provisioning, or anything else during onboarding, reach out to your KeyStone onboarding contact or contact us.

​
Next steps

Quickstart

Submit your first settlement instruction in minutes.

Authentication

Set up M2M credentials and obtain access tokens.