Onboarding Overview & Checklist

Before your first API call succeeds — including in staging — a one-time technical onboarding process must be completed. This page is the master checklist for that process. Each step links to a page with the full detail; this page exists so you can see the whole journey at a glance and know where you are in it.

The journey at a glance

sequenceDiagram
    participant Tenant
    participant Axys as Axys Platform

    Tenant->>Tenant: Generate RSA key pair and CSR
    Tenant->>Axys: Submit CSR
    Axys->>Tenant: Issue signed client certificate
    Tenant->>Axys: Provide calling IPs for allowlisting
    Tenant->>Tenant: Configure A records and PTR records
    Axys->>Tenant: Confirm IP allowlist and issue tenant API key
    Tenant->>Axys: Create first Program
    Axys->>Tenant: Issue Program certificate and API key
    Tenant->>Axys: Make first staging API call
    Axys->>Tenant: Return 200 OK

The checklist

1–3. Certificate issuance

Generate an RSA-2048 key pair and a certificate signing request (CSR), then submit it to Axys. A signed mTLS client certificate is returned, typically within 24 hours. The CSR's subject fields establish your identity in the platform's hierarchy (O = your Tenant, OU = your Program's trading name(s)).

→ Full detail: mTLS Certificates & CSR

4–6. Network security

Provide the IP address(es) your servers will call the API from, and configure DNS so that:

• the domain(s) in your certificate's CN/SAN resolve (via A records) to your calling IP(s), and
• your calling IP(s) have PTR records resolving back to those domains (forward-confirmed reverse DNS).

Both your IP allowlist entry and DNS configuration are checked on every request, independently of the mTLS handshake itself.

→ Full detail: IP Allowlisting & Network Security

7–8. Program creation and credentials

With your Tenant-level certificate and API Key, create your first Program (configuring its currency, transaction limit ceiling, and at least one Card Design — slot 0). Axys issues a separate certificate and API Key scoped to that Program.

→ See Program Architecture for the Tenant/Program relationship, and Setup a New Program for the walkthrough.

9–10. First API call

Using your Program-level certificate and API key, make your first call — see Your First API Call.

What you'll need before you start

• The ability to generate an RSA key pair and CSR (OpenSSL or equivalent)
• Control over DNS for the domain(s) you'll use to call the API
• A static, known calling IP address (or a small set of them — e.g. NAT gateway Elastic IPs)
• Your Tenant's legal entity name and the trading/brand name(s) for your Program(s)

What's next

• mTLS Certificates & CSR
• IP Allowlisting & Network Security
• Security Compliance & Data Protection