Before you start
You will collect five values, make one certificate file, and send that file to Envestnet. No command line is needed.
Who needs to be involved:
Your firm's Envestnet Partner Admin (Root or Secondary). Only they can see the API key and secret in the Envestnet Developer Portal.
Whoever manages your firm's relationship with Envestnet, to send the certificate in Step 3.
A Caddi admin at your firm, to enter the values in Step 4.
What you will end up with:
Value | Where it comes from |
API Gateway Key | Envestnet Developer Portal (Step 1) |
API Gateway Secret | Envestnet Developer Portal (Step 1) |
Firm Issuer | A name you choose and tell Envestnet (Step 3) |
Advisor Federated ID | Envestnet, or your Tamarac admin (Step 3) |
Certificate Private Key | The file you create in Step 2 |
Use your production Envestnet credentials, not UAT or sandbox. Caddi connects to Envestnet's production environment.
Step 1: Get your API gateway key and secret
Your firm's Partner Admin copies a Key and a Secret from the Envestnet Developer Portal.
Sign in at developer.envestnet.com.
Click Dashboard in the top menu.
Find the production credentials and copy the Key and the Secret. Envestnet issues separate pairs for UAT and production; use production.
Store both somewhere safe, such as your password manager. You will paste them into Caddi in Step 4.
No Dashboard tab, or no credentials on it? Email OpenENVProductManagement@envestnet.com and name the product "Tamarac External API" in the request.
Step 2: Create your certificate and private key
One OpenSSL command creates two files: a certificate you send to Envestnet and a private key you give only to Caddi. Envestnet requires a 2048-bit RSA key.
Where to run it:
macOS or Linux: Terminal. OpenSSL is already installed.
Windows: a WSL (Ubuntu) shell, or Git Bash, both of which include OpenSSL.
Replace the firm name in the command, then run it:
openssl req -x509 -newkey rsa:2048 -nodes -sha256 -days 730 \ -keyout tamarac-private-key.pem \ -out tamarac-certificate.pem \ -subj "/CN=Example Firm Tamarac API/O=Example Firm LLP/C=US"
Check the result:
openssl x509 -in tamarac-certificate.pem -noout -subject -enddate
This prints your firm name and an expiry date two years out.
File | What it is | Who gets it |
tamarac-certificate.pem | Public certificate, starts with -----BEGIN CERTIFICATE----- | Envestnet (Step 3) |
tamarac-private-key.pem | Private key, starts with -----BEGIN PRIVATE KEY----- | Caddi only (Step 4) |
Never email the private key or send it to Envestnet. The command leaves it without a password because Caddi needs to read it; protect the file like a password.
Step 3: Register the certificate with Envestnet
Envestnet must store your certificate and issuer before any connection works. In return, confirm the advisor's federated ID with them.
Choose an issuer: a short name that identifies your firm, such as your web domain (
examplefirm.com). It must match exactly in Step 4.Email your Envestnet contact (your Service Account Manager, or OpenENVProductManagement@envestnet.com) with
tamarac-certificate.pemattached.Wait for Envestnet to confirm the certificate is on your firm's OAuth configuration.
Email template:
Subject: Tamarac External API – JWT bearer certificate for [Firm name] Hello, Please add the attached X.509 certificate (2048-bit RSA) to our firm's OAuth configuration for the Tamarac External API, for the JWT bearer grant. - Firm: [Firm name] - Environment: Production - Issuer (iss): [examplefirm.com] - API gateway key: [first 6 characters of the Key from Step 1] Please also confirm the federated ID for the advisor account [advisor name or email] that the API should act as. Thank you, [Name, title, phone]
Never attach tamarac-private-key.pem.
Step 4: Connect Tamarac in Caddi
Once Envestnet confirms Step 3, add the connection named Tamarac - Custom API Client in Caddi and fill in the form.
Caddi field | What to enter |
API Gateway Key | The Key from Step 1 |
API Gateway Secret | The Secret from Step 1 |
Firm Issuer | The issuer you sent Envestnet in Step 3, exactly as sent |
Advisor Federated ID | The federated ID Envestnet confirmed in Step 3 |
Certificate Private Key | The full contents of |
Partner ID | Leave blank unless Envestnet gave your firm more than one partner ID |
API Permissions | Leave the prefilled value as is |
To copy the private key on macOS without opening it:
pbcopy < tamarac-private-key.pem
On Windows, open the file in Notepad and copy everything. After saving, delete your local copy of tamarac-private-key.pem or move it into your firm's secrets vault.
Troubleshooting
Most failures come from a mismatch between what Envestnet stored and what Caddi sends.
Symptom | Likely cause | Fix |
Connection fails right away | Key or Secret is wrong, or is the UAT pair | Re-copy the production pair from Step 1 |
Rejected after Envestnet setup | Certificate not registered yet, or the private key doesn't match it | Confirm with Envestnet; run the match check below |
Rejected for issuer | Firm Issuer differs from what Envestnet stored | Enter it exactly as in your Step 3 email |
User not found | Advisor Federated ID is wrong | Ask Envestnet to confirm the ID |
Worked before, now fails | Certificate expired (two years after Step 2) | Repeat Steps 2 to 4 with a new certificate |
Match check: both commands must print the same value.
openssl x509 -noout -modulus -in tamarac-certificate.pem | openssl md5 openssl rsa -noout -modulus -in tamarac-private-key.pem | openssl md5
Set a calendar reminder about a month before the certificate's expiry date, which Step 2's check printed.