Abstract: Seamlessly securing access to application programming interface gateways includes receiving a request from a client for a token using which the client can make a call to an API. The request includes a client identifier identifying the client. In response to receiving the request, a call is made to the API for the token, and the token, including application credentials, are received from the API. In response to receiving the token, the token is encoded to include the encrypted client identifier and the encrypted application credentials. The encoded token is transmitted to the client.