---
title: "Configure client settings"
method: POST
path: "/setup"
tags: ["Clients"]
---

# Configure client settings

`POST /setup`

Configure webhook URL, secret, sponsorship, source-token whitelist, and app-fee rules for a project. Deposit whitelist keys must use CAIP-2 chain identifiers (for example "eip155:8453"). App-fee token overrides take precedence over the project fallback; feeBps 0 clears only the fallback, while appFees null clears fallback and overrides.

## Headers

- `x-api-key` string — API key for authentication (omit when sending Authorization)
- `authorization` string — Bearer platform token (e.g. forwarded by user-service). Takes precedence over `x-api-key` when both are present.
- `x-api-version` string — API version identifier (e.g. "2026-04.amazon"). Optional today, will become required in a future release.

## Request body

- SetupRequestBody
  - `params` ClientInput, required
    - `webhookUrl` string, uri, nullable
    - `webhookSecret` string, nullable
    - `sponsorship` object
    - `depositWhitelist` DepositWhitelist — Per-source-chain deposit allowlist keyed by CAIP-2 chain identifiers (for example "eip155:8453"). Each key maps to allowed source tokens and optional min/max amount limits in raw token units.
    - `maxPriceDeviationBps` integer, nullable — Maximum allowed price deviation in basis points for stablecoin-to-stablecoin bridges. Defaults to 200 (2%) if not set.
    - `minDepositUsd` number, nullable — Minimum deposit value in USD. Deposits priced below this are rejected and the client is notified via deposit-rejected. Applies to all tokens and chains.
    - `appFees` AppFees, nullable — Project app-fee settings. An exact normalized source chain+token rate, including 0, overrides feeBps; unmatched source assets use feeBps or 0 when omitted. On update, feeBps 0 clears only the fallback when tokens is omitted; appFees null clears fallback and overrides.
      - `feeBps` integer
      - `tokens` object

## Response `200`

Client updated successfully

- SetupResponse
  - `message` string, required

## Other responses

- `400` — Invalid request parameters
- `401` — Authentication required (missing/invalid API key or token)
- `403` — API key lacks required deposits scope
- `503` — Client credential could not be persisted; retry after the Retry-After delay

---

[API](https://skmtc.net/rhinestonewtf/apis/deposit-service-api.md) · [All operations](https://skmtc.net/rhinestonewtf/apis/deposit-service-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/rhinestonewtf/deposit-service-api/versions/ce4e0abfe33a/schema)