Client Onboarding & API Access
The ImPAI platform provides selected clients — both personal and business — secure programmatic access to our services through APIs. This chapter explains how to get credentials, authenticate, and start integrating.
Eligibility Requirements
To gain access to the ImPAI API, clients must complete the required KYC/KYB (Know-Your-Customer/Know-Your-Business) verification process.
To request onboarding, please contact us at info@im-par.de.
Once verified, access credentials will be issued following the onboarding steps below.
Onboarding Process
- Verification: Complete all regulatory KYC/KYB requirements.
- Application: Request API access through your account manager.
- Approval: ImPAI team reviews and confirms the request.
- Credential Generation: Unique credentials are created for your application.
- Integration: Begin implementing the API with your development team.
API Credentials Issued
Upon successful onboarding, you will receive credentials to authenticate using the OAuth 2.0 Password Credentials Grant flow:
| Credential | Description | Usage |
|---|---|---|
| Client ID | Unique identifier for your application | Required in all API calls |
| Client Secret | Confidential key for your Client ID | Used to obtain access tokens |
| Username | Assigned login username | Required for authentication |
| Password | Corresponding password | Required for authentication |
Store all credentials securely.
Never expose your Client Secret, Password, or Shared Secret in client-side code or public repositories.
How Authentication Works
ImPAI uses industry-standard OAuth 2.0 to ensure secure authorization of all requests.
Flow Overview
- Your application sends the issued credentials to the authentication endpoint
- The system issues time-limited access and refresh tokens
- Your application includes the access token in the
Authorizationheader for each request - When the access token expires, the refresh token allows silent renewal without user input
| Legend | |
| Access Token | Used for all API requests (short-lived) |
| Refresh Token | Used to renew access without re-login (longer-lived) |
This approach ensures:
✅ Granular permission control
✅ Secure session lifecycle
✅ Full auditability of access events
For detailed information on the authentication flow, see 👉 Authentication.
Next Steps
Once onboarded:
- Review the Authentication documentation to learn how to request and refresh access tokens.
- Start integrating with the API endpoints required for your solution.
For technical support, contact your account manager or our developer support team.