Authentication and access

Configure the base URL, bearer credential, request format, and operational time zone.

Connection details

Setting	Value
Base URL	https://pamm-api.example.com
CRM Swagger	https://pamm-api.example.com/docs/crm
Authentication	Bearer CRM API key supplied through a secure channel
Media type	application/json; charset=utf-8
Operating time zone	UTC (+00:00)

Required headers

Authorization: Bearer YOUR_CRM_API_KEY
Accept: application/json
Content-Type: application/json

curl "https://pamm-api.example.com/api/v1/master/directory?engine=PAMM&limit=50" \
  -H "Authorization: Bearer YOUR_CRM_API_KEY" \
  -H "Accept: application/json"

Store the CRM API key only in backend secret storage. Do not include it in repositories, screenshots, browser requests, mobile applications, logs, or analytics tools.

Use HTTPS for every environment. If IP allowlisting is enabled, coordinate the CRM’s outbound addresses before testing. Do not silently switch credentials when a route returns 403; confirm that the endpoint belongs to the customer’s CRM contract.

Secret-bearing responses

Account creation and sensitive information routes may return MT5 passwords. Encrypt only the fields your authorized workflow requires and prevent complete response bodies from reaching application logs.

Previous: Integration model

Return to system ownership and fund separation.

Next: End-to-end workflow

Implement the recommended integration sequence.