The two things that must be true before the Rise B2B API will answer you: your wallet is authorized on your RiseID, and your company is enabled for the API.
Both are set up in the app, and until both are done the API answers with a 403, even when your code and credentials are perfect:
Your API wallet is authorized on your RiseID. The wallet you sign with needs an Owner, Payer, or Treasurer role on your personal RiseID.
You have enabled your company for the B2B API. The API is off by default. You switch it on per environment and company, so staging and production are enabled separately.
The two sections below walk through each step. If you get stuck, the reference at the end matches each error to its fix.
The wallet you sign with has to be authorized on your personal RiseID before the login handshake will hand you a token. Authorizing it in the app gives it the Owner role, which the B2B API accepts (Owner, Payer, and Treasurer all work).
Open Security from the left menu. 2. Under Authorized Wallets, click Add Wallet.
Under Authorized Wallets, click Add Wallet, choose the wallet type, paste the wallet’s address, and confirm. Don’t have a wallet yet? See Creating your first wallet.
3
Sign the change
Sign the prompt with a wallet that is already authorized on your RiseID. This records the new wallet’s role on-chain.
4
Wait for confirmation
Give the transaction a moment to confirm before you log in. Until it’s confirmed, the handshake still sees the wallet as unauthorized and returns a 403.
The Add authorized wallet dialog: pick the wallet type, paste the address, and confirm.
This wallet’s private key can move money. Guard it accordingly. The role you just granted is signing authority, not just a login. Anyone who holds the key can log in as you and sign payments and withdrawals for every team the wallet can reach, and Owner (the role the app grants here) can do everything the account can, including authorizing more wallets. Keep the key in a secret manager or HSM, never in code, a repo, a log, or anything client-side. If it ever leaks, remove the wallet under Security → Authorized Wallets straight away (that strips its on-chain role), then switch to a fresh one. A leaked key keeps working until you revoke it, unlike a token that expires in 24 hours.
Use a dedicated wallet for API operations rather than one holding funds. It needs no balance, since Rise pays the gas. See Secondary Wallets.
The B2B API is off by default. You turn it on yourself in the app, no support request needed. This is a per-company setting, and staging and production are enabled separately.
1
Open the company workspace
Switch into the workspace for the company you want to enable. Pick it on the account selection page, or from the account switcher in the left menu.
2
Open the API Config page
In the left menu, expand B2B API and go to API Config.
Expand B2B API in the left menu. 2. Open API Config.
3
Turn on Rise API access
Toggle Enable Rise API access.
4
Save and verify
Click Save. You’ll be prompted to confirm the change with your passkey and wallet. Once it goes through, the company is enabled for this environment.
Turn on Enable Rise API access. 4. Click Save.
Staging and production are enabled independently. They run on separate databases, so enabling your company in staging does not enable it in production. Turn on each environment you plan to use. Most teams enable staging first to build against, then production before going live.
Until this is done, calls that resolve to your company return:
{ "success": false, "data": "Company is not enabled for B2B API access", "error_code": "B2B_ACCESS_DENIED"}
The login handshake authenticates a user, so the riseid you send is your personal (user) RiseID, not a company or team RiseID, and not your Rise Account address. Sending anything else returns 404 No entity found with riseid <id>.To find it in the app:
1
Open My Profile
Sign in to app.riseworks.io, open the user menu on the top bar (or the Account section of the left menu), and go to My Profile.
2
Copy the Rise ID
Under Details, copy the value in the Rise ID field. It’s a 42-character address that starts with 0x, for example 0x2DF5...b089.
Open My Profile from the left menu. 2. Under Details, copy the Rise ID (the bare 0x), not the Rise Account below it.
The same page shows a second address labelled Rise Account. That is not your RiseID and it won’t authenticate. Use the field labelled Rise ID. Mixing the two up is a common cause of the 404 above.
Send the bare 0x address, with no prefix. The Rise ID card in the sidebar shows the same value with a network prefix (arb4:0x…). Drop the arb4: (or eth: / arb1:) part, and the API matches on the plain 0x… shown in the Rise ID field. It is also not one of your us-, co-, or te- nanoids. A prefixed value or a nanoid is the single most common cause of 404 No entity found with riseid.
Company and team RiseIDs are used for API operations like payments and balances, addressed by their co- / te- nanoids rather than by the login handshake. See RiseID for how the identity hierarchy fits together.
This is the wallet you authorized under Security → Authorized Wallets in Authorize your API wallet. You pass its address as wallet and sign the SIWE challenge with its private key. To confirm which wallets can sign in, open the API Config page and check RiseID permissions for API.Once you have both values, run the authentication handshake. A successful GET /v2/me confirms the wallet is authorized and the token is valid; a scoped call like fetching a team or balance confirms your company is enabled for the environment.
Whenever you work with a third-party provider, create an account-level scoped credential with the Payment Initiator role rather than sharing a signing wallet. A Payment Initiator can create payment intents, which then have to be approved before they’re processed, so the provider can queue payments without being able to move money on its own.
1
Open the API Config page
In the Organization left menu, expand B2B API and go to API Config.
Expand B2B API in the left menu. 2. Open API Config.
2
Select the account and add a wallet
Under Account permissions for API, select the account you want to scope the credential to, then click Add account wallet.
Select the account. 4. Click Add account wallet.
3
Name and add the wallet
Set the Role to Payment Initiator, give the wallet a name and address, click Add wallet, and verify the operation.
The Add account wallet dialog: pick the Payment Initiator role, name the wallet, and paste its address.
The two prerequisites are checked at different points, which is why they fail differently:
The wallet-role check runs during the login handshake, so a wrong or unauthorized wallet fails at login. Company enablement is checked later, on the first request that names a company or team, so an un-enabled company can still log in and read /v2/me but gets a 403 the moment it touches a team or payment.
If you’re still blocked, match the response to the cause:
Response
Cause
Fix
404 No entity found with riseid <id>
The riseid has a network prefix (arb4:), is a us-/co-/te- nanoid, or is a company/team RiseID
Send the bare 0x from the Rise ID field on My Profile, prefix stripped
400 Wallet address is required / 400 riseid is required
GET /v2/auth/siwe was called without the wallet or riseid query param
Pass both: /v2/auth/siwe?wallet=<0x>&riseid=<0x>
403 Wallet <addr> is not an authorized member...
The signing wallet has no authorized role on the RiseID, or the grant hasn’t confirmed on-chain yet
Authorize the wallet under Security, then wait for the transaction to confirm
403 Company is not enabled for B2B API access
Company not enabled for this environment
Enable it in the app, and check you’re pointed at the environment you enabled
401 Authentication required. Please provide Authorization...
The token is missing or malformed on a call that needs it
Send Authorization: Bearer <jwt> from the handshake (the SDK does this for you)
SIWE error: Signature does not match address...
A different wallet signed than the one in the message, or the message was altered before signing
Sign the exact data.siwe string with the same wallet you passed as wallet
The Authorized Wallets panel doesn’t list wallets that already hold a role, so an empty panel doesn’t mean the save failed. Confirm a wallet’s role from the login handshake succeeding, or by checking the RiseID on Arbiscan.
Authorizing a wallet for a specific team instead
Adding a wallet under Security → Authorized Wallets authorizes it on your personal RiseID, and that authority carries down to the companies and teams you own. If you’d rather scope a wallet to one team, switch to that team’s workspace, open Settings, and use Delegate Wallets → Add delegate (name plus address). The app text there reads “Add delegate wallets to authorize API transactions.”Selecting a specific Payer or Treasurer role (rather than Owner) isn’t exposed in the app yet. If you need a wallet scoped to one of those roles, ask Rise when you request access.
