diff --git a/apps/app/src/main/scala/org/lfdecentralizedtrust/splice/config/ConfigTransforms.scala b/apps/app/src/main/scala/org/lfdecentralizedtrust/splice/config/ConfigTransforms.scala
index 39ce59e2eb2..aab3f10fadb 100644
--- a/apps/app/src/main/scala/org/lfdecentralizedtrust/splice/config/ConfigTransforms.scala
+++ b/apps/app/src/main/scala/org/lfdecentralizedtrust/splice/config/ConfigTransforms.scala
@@ -197,6 +197,7 @@ object ConfigTransforms {
       makeAllTimeoutsBounded,
       ensureNovelDamlNames(testId),
       useSelfSignedTokensForLedgerApiAuth("test"),
+      useSelfSignedTokensForParticipantAdminApiAuth("test", "test-scope"),
       reducePollingInterval,
       withPausedSvDomainComponentsOffboardingTriggers(),
       disableOnboardingParticipantPromotionDelay(),
@@ -581,7 +582,7 @@ object ConfigTransforms {
         config
           .focus(_.participantClient.ledgerApi.clientConfig.port)
           .modify(setPortPrefix(range))
-          .focus(_.participantClient.adminApi.port)
+          .focus(_.participantClient.adminApi.clientConfig.port)
           .modify(setPortPrefix(range))
           .focus(_.localSynchronizerNodes.current)
           .modify(setSvSynchronizerConfigPortsPrefix(range, _))
@@ -640,7 +641,7 @@ object ConfigTransforms {
         config
           .focus(_.participantClient.ledgerApi.clientConfig.port)
           .modify(setPortPrefix(range))
-          .focus(_.participantClient.adminApi.port)
+          .focus(_.participantClient.adminApi.clientConfig.port)
           .modify(setPortPrefix(range))
           .focus(_.adminApi.internalPort)
           .modify(_.map(setPortPrefix(range)))
@@ -697,7 +698,7 @@ object ConfigTransforms {
         config
           .focus(_.participantClient.ledgerApi.clientConfig.port)
           .modify(setPortPrefix(range))
-          .focus(_.participantClient.adminApi.port)
+          .focus(_.participantClient.adminApi.clientConfig.port)
           .modify(setPortPrefix(range))
           .focus(_.adminApi.internalPort)
           .modify(_.map(setPortPrefix(range)))
@@ -854,7 +855,7 @@ object ConfigTransforms {
       mediator = portTransform(bump, c.mediator),
     )
 
-  private def portTransform(bump: Int, c: LedgerApiClientConfig): LedgerApiClientConfig =
+  private def portTransform(bump: Int, c: ClientConfigWithAuth): ClientConfigWithAuth =
     c.focus(_.clientConfig).modify(portTransform(bump, _))
 
   private def portTransform(
@@ -905,7 +906,7 @@ object ConfigTransforms {
   }
 
   private def updateAllLedgerApiClientConfigs(
-      enableAuth: (String, LedgerApiClientConfig) => LedgerApiClientConfig
+      enableAuth: (String, ClientConfigWithAuth) => ClientConfigWithAuth
   ): ConfigTransform = {
     combineAllTransforms(
       updateAllValidatorConfigs_(c => {
@@ -928,8 +929,8 @@ object ConfigTransforms {
 
   def selfSignedTokenAuthSourceTransform(clockConfig: ClockConfig, secret: String)(
       user: String,
-      c: LedgerApiClientConfig,
-  ): LedgerApiClientConfig = {
+      c: ClientConfigWithAuth,
+  ): ClientConfigWithAuth = {
     val userToken = AuthUtil.LedgerApi.testToken(
       user = user,
       secret = secret,
@@ -942,6 +943,51 @@ object ConfigTransforms {
     )
   }
 
+  def useSelfSignedTokensForParticipantAdminApiAuth(
+      secret: String,
+      scope: String,
+  ): ConfigTransform = { config =>
+    modifyAllParticipantAdminApiConfigs { (adminApi, _) =>
+      adminApi.copy(
+        authConfig = AuthTokenSourceConfig.Static(
+          token = AuthUtil.CantonAdminApi.testToken(secret, scope),
+          adminToken = Some(AuthUtil.CantonAdminApi.testToken(secret, scope)),
+        )
+      )
+    }(config)
+  }
+
+  private def modifyAllParticipantAdminApiConfigs(
+      modify: (ClientConfigWithAuth, BaseParticipantClientConfig) => ClientConfigWithAuth
+  ): ConfigTransform =
+    combineAllTransforms(
+      updateAllValidatorConfigs_(
+        _.focus(_.participantClient).modify(participantClient =>
+          participantClient.copy(adminApi = modify(participantClient.adminApi, participantClient))
+        )
+      ),
+      updateAllSvAppConfigs_(
+        _.focus(_.participantClient).modify(participantClient =>
+          participantClient.copy(adminApi = modify(participantClient.adminApi, participantClient))
+        )
+      ),
+      updateAllScanAppConfigs_(
+        _.focus(_.participantClient).modify(participantClient =>
+          participantClient.copy(adminApi = modify(participantClient.adminApi, participantClient))
+        )
+      ),
+      updateAllSplitwellAppConfigs_(
+        _.focus(_.participantClient).modify(participantClient =>
+          participantClient.copy(adminApi = modify(participantClient.adminApi, participantClient))
+        )
+      ),
+      updateAllRemoteSplitwellAppConfigs_(
+        _.focus(_.participantClient).modify(participantClient =>
+          participantClient.copy(adminApi = modify(participantClient.adminApi, participantClient))
+        )
+      ),
+    )
+
   def useSplitwellUpgradeDomain(): ConfigTransform =
     updateAllSplitwellAppConfigs_(c => {
       c.copy(
diff --git a/apps/app/src/main/scala/org/lfdecentralizedtrust/splice/config/SpliceConfig.scala b/apps/app/src/main/scala/org/lfdecentralizedtrust/splice/config/SpliceConfig.scala
index 5c60f3da78c..c9a3c2eaaea 100644
--- a/apps/app/src/main/scala/org/lfdecentralizedtrust/splice/config/SpliceConfig.scala
+++ b/apps/app/src/main/scala/org/lfdecentralizedtrust/splice/config/SpliceConfig.scala
@@ -480,8 +480,8 @@ object SpliceConfig {
     implicit val ingestionConfig: ConfigReader[IngestionConfig] = deriveReader[IngestionConfig]
     implicit val automationConfig: ConfigReader[AutomationConfig] =
       deriveReader[AutomationConfig]
-    implicit val LedgerApiClientConfigReader: ConfigReader[LedgerApiClientConfig] =
-      deriveReader[LedgerApiClientConfig]
+    implicit val LedgerApiClientConfigReader: ConfigReader[ClientConfigWithAuth] =
+      deriveReader[ClientConfigWithAuth]
     implicit val ParticipantClientConfigReader: ConfigReader[ParticipantClientConfig] =
       deriveReader[ParticipantClientConfig]
     implicit val appInstanceReader: ConfigReader[AppInstance] =
@@ -1033,8 +1033,8 @@ object SpliceConfig {
     implicit val ingestionConfig: ConfigWriter[IngestionConfig] = deriveWriter[IngestionConfig]
     implicit val automationConfig: ConfigWriter[AutomationConfig] =
       deriveWriter[AutomationConfig]
-    implicit val LedgerApiClientConfigWriter: ConfigWriter[LedgerApiClientConfig] =
-      deriveWriter[LedgerApiClientConfig]
+    implicit val LedgerApiClientConfigWriter: ConfigWriter[ClientConfigWithAuth] =
+      deriveWriter[ClientConfigWithAuth]
     implicit val ParticipantClientConfigWriter: ConfigWriter[ParticipantClientConfig] =
       deriveWriter[ParticipantClientConfig]
     implicit val appInstanceWriter: ConfigWriter[AppInstance] =
diff --git a/apps/app/src/main/scala/org/lfdecentralizedtrust/splice/console/SpliceInstanceReference.scala b/apps/app/src/main/scala/org/lfdecentralizedtrust/splice/console/SpliceInstanceReference.scala
index 4cb835ca7a1..afb68c2a0b2 100644
--- a/apps/app/src/main/scala/org/lfdecentralizedtrust/splice/console/SpliceInstanceReference.scala
+++ b/apps/app/src/main/scala/org/lfdecentralizedtrust/splice/console/SpliceInstanceReference.scala
@@ -258,16 +258,26 @@ trait AppBackendReference extends AppReference with LocalInstanceReference {
   private def getRemoteParticipantConfigWithToken(
       participantClientConfig: BaseParticipantClientConfig
   )(implicit ec: ExecutionContext): RemoteParticipantConfig = {
-    val tokenStrO = Await.result(
-      spliceConsoleEnvironment.httpClient
-        .getToken(participantClientConfig.ledgerApi.authConfig)
-        .map(_.map(_.accessToken)),
+    val (maybeLedgerApiToken, maybeAdminApiToken) = Await.result(
+      {
+        val maybeLedgerApiTokenF = spliceConsoleEnvironment.httpClient
+          .getToken(participantClientConfig.ledgerApi.authConfig)
+          .map(_.map(_.accessToken))
+        val maybeAdminApiTokenF = spliceConsoleEnvironment.httpClient
+          .getToken(participantClientConfig.adminApi.authConfig)
+          .map(_.map(_.accessToken))
+        for {
+          maybeLedgerApiToken <- maybeLedgerApiTokenF
+          maybeAdminApiToken <- maybeAdminApiTokenF
+        } yield (maybeLedgerApiToken, maybeAdminApiToken)
+      },
       30.seconds,
     )
     RemoteParticipantConfig(
-      participantClientConfig.adminApi,
+      participantClientConfig.adminApi.clientConfig,
       participantClientConfig.ledgerApi.clientConfig,
-      token = tokenStrO,
+      ledgerApiToken = maybeLedgerApiToken,
+      adminApiToken = maybeAdminApiToken,
     )
   }
   implicit val ec: ExecutionContext = executionContext
diff --git a/apps/app/src/test/resources/include/participant-admin-api-auth-test.conf b/apps/app/src/test/resources/include/participant-admin-api-auth-test.conf
new file mode 100644
index 00000000000..b600f809b65
--- /dev/null
+++ b/apps/app/src/test/resources/include/participant-admin-api-auth-test.conf
@@ -0,0 +1,11 @@
+_shared_participant_admin_api {
+  auth-services = [
+    # used by most of our tests
+    {
+      type = unsafe-jwt-hmac-256
+      secret = "test"
+      target-scope = "test-scope"
+      privileged = true
+    }
+  ]
+}
diff --git a/apps/app/src/test/resources/include/participants.conf b/apps/app/src/test/resources/include/participants.conf
index 7556b891f24..3b35622b490 100644
--- a/apps/app/src/test/resources/include/participants.conf
+++ b/apps/app/src/test/resources/include/participants.conf
@@ -1,5 +1,6 @@
 include required("storage-postgres.conf")
 include required("ledger-api-auth-test.conf")
+include required("participant-admin-api-auth-test.conf")
 
 _participant_template {
   init {
@@ -9,6 +10,7 @@ _participant_template {
     identity.type = manual
   }
   ledger-api.auth-services = ${_shared.auth-services}
+  admin-api.auth-services = ${_shared_participant_admin_api.auth-services}
   storage = ${_shared.storage}
   parameters {
     # tune the synchronisation protocols contract store cache
diff --git a/apps/app/src/test/resources/include/scans/_scan.conf b/apps/app/src/test/resources/include/scans/_scan.conf
index b623e19de3f..1e0137f82dc 100644
--- a/apps/app/src/test/resources/include/scans/_scan.conf
+++ b/apps/app/src/test/resources/include/scans/_scan.conf
@@ -13,6 +13,7 @@
   instance-lock-enabled = false
   admin-api.address = 0.0.0.0
   participant-client {
+    admin-api.auth-config.type = "none"
     ledger-api.auth-config.type = "none"
   }
 
diff --git a/apps/app/src/test/resources/include/scans/sv1-scan.conf b/apps/app/src/test/resources/include/scans/sv1-scan.conf
index b76d73fe221..fe284c4cecb 100644
--- a/apps/app/src/test/resources/include/scans/sv1-scan.conf
+++ b/apps/app/src/test/resources/include/scans/sv1-scan.conf
@@ -2,7 +2,7 @@
   include required("_scan")
 
   participant-client = {
-    admin-api.port = 5102
+    admin-api.client-config.port = 5102
     ledger-api.client-config.port = 5101
   }
   synchronizer-nodes.current.sequencer.port = 5109
diff --git a/apps/app/src/test/resources/include/scans/sv2-scan.conf b/apps/app/src/test/resources/include/scans/sv2-scan.conf
index 92065dd279d..eb1e5e397df 100644
--- a/apps/app/src/test/resources/include/scans/sv2-scan.conf
+++ b/apps/app/src/test/resources/include/scans/sv2-scan.conf
@@ -2,7 +2,7 @@
   include required("_scan")
 
   participant-client = {
-    admin-api.port = 5202
+    admin-api.client-config.port = 5202
     ledger-api.client-config.port = 5201
   }
   synchronizer-nodes.current.sequencer.port = 5209
diff --git a/apps/app/src/test/resources/include/scans/sv3-scan.conf b/apps/app/src/test/resources/include/scans/sv3-scan.conf
index e043d88417f..0d259869a18 100644
--- a/apps/app/src/test/resources/include/scans/sv3-scan.conf
+++ b/apps/app/src/test/resources/include/scans/sv3-scan.conf
@@ -2,7 +2,7 @@
   include required("_scan")
 
   participant-client = {
-    admin-api.port = 5302
+    admin-api.client-config.port = 5302
     ledger-api.client-config.port = 5301
   }
   synchronizer-nodes.current.sequencer.port = 5309
diff --git a/apps/app/src/test/resources/include/scans/sv4-scan.conf b/apps/app/src/test/resources/include/scans/sv4-scan.conf
index d369d68c852..05669740cc0 100644
--- a/apps/app/src/test/resources/include/scans/sv4-scan.conf
+++ b/apps/app/src/test/resources/include/scans/sv4-scan.conf
@@ -2,7 +2,7 @@
   include required("_scan")
 
   participant-client = {
-    admin-api.port = 5402
+    admin-api.client-config.port = 5402
     ledger-api.client-config.port = 5401
   }
   synchronizer-nodes.current.sequencer.port = 5409
diff --git a/apps/app/src/test/resources/include/svs/_sv.conf b/apps/app/src/test/resources/include/svs/_sv.conf
index f13c2b775f8..6bdb541e575 100644
--- a/apps/app/src/test/resources/include/svs/_sv.conf
+++ b/apps/app/src/test/resources/include/svs/_sv.conf
@@ -10,8 +10,9 @@
   }
   instance-lock-enabled = false
   participant-client = {
-    admin-api.port = 5102
+    admin-api.client-config.port = 5102
     ledger-api.client-config.port = 5101
+    admin-api.auth-config.type = "none"
     ledger-api.auth-config.type = "none" # we override this via config transform
   }
   auth {
diff --git a/apps/app/src/test/resources/include/svs/sv2.conf b/apps/app/src/test/resources/include/svs/sv2.conf
index e60414a98d3..25e2fe9a7bb 100644
--- a/apps/app/src/test/resources/include/svs/sv2.conf
+++ b/apps/app/src/test/resources/include/svs/sv2.conf
@@ -1,7 +1,7 @@
 {
   include required("_sv")
   participant-client = {
-    admin-api.port = 5202
+    admin-api.client-config.port = 5202
     ledger-api.client-config.port = 5201
   }
   admin-api.port = 5214
diff --git a/apps/app/src/test/resources/include/svs/sv3.conf b/apps/app/src/test/resources/include/svs/sv3.conf
index d71a8767629..9079181a666 100644
--- a/apps/app/src/test/resources/include/svs/sv3.conf
+++ b/apps/app/src/test/resources/include/svs/sv3.conf
@@ -1,7 +1,7 @@
 {
   include required("_sv")
   participant-client = {
-    admin-api.port = 5302
+    admin-api.client-config.port = 5302
     ledger-api.client-config.port = 5301
   }
   admin-api.port = 5314
diff --git a/apps/app/src/test/resources/include/svs/sv4.conf b/apps/app/src/test/resources/include/svs/sv4.conf
index dac2fea28b9..0d4afe184e5 100644
--- a/apps/app/src/test/resources/include/svs/sv4.conf
+++ b/apps/app/src/test/resources/include/svs/sv4.conf
@@ -1,7 +1,7 @@
 {
   include required("_sv")
   participant-client = {
-    admin-api.port = 5402
+    admin-api.client-config.port = 5402
     ledger-api.client-config.port = 5401
   }
   admin-api.port = 5414
diff --git a/apps/app/src/test/resources/include/validators/_validator.conf b/apps/app/src/test/resources/include/validators/_validator.conf
index 01395874f8a..86e67a94744 100644
--- a/apps/app/src/test/resources/include/validators/_validator.conf
+++ b/apps/app/src/test/resources/include/validators/_validator.conf
@@ -10,6 +10,7 @@
   instance-lock-enabled = false
 
   participant-client = {
+    admin-api.auth-config.type = "none"
     ledger-api.auth-config.type = "none"
   }
   auth {
diff --git a/apps/app/src/test/resources/include/validators/alice-validator.conf b/apps/app/src/test/resources/include/validators/alice-validator.conf
index 16777991247..890f35d5917 100644
--- a/apps/app/src/test/resources/include/validators/alice-validator.conf
+++ b/apps/app/src/test/resources/include/validators/alice-validator.conf
@@ -3,7 +3,7 @@
 
   admin-api.port = 5503
   participant-client = {
-    admin-api.port = 5502
+    admin-api.client-config.port = 5502
     ledger-api.client-config.port = 5501
   }
   ledger-api-user = "alice_validator_user"
diff --git a/apps/app/src/test/resources/include/validators/bob-validator.conf b/apps/app/src/test/resources/include/validators/bob-validator.conf
index 49cefb96a4c..8156997d41a 100644
--- a/apps/app/src/test/resources/include/validators/bob-validator.conf
+++ b/apps/app/src/test/resources/include/validators/bob-validator.conf
@@ -3,7 +3,7 @@
 
   admin-api.port = 5603
   participant-client = {
-    admin-api.port = 5602
+    admin-api.client-config.port = 5602
     ledger-api.client-config.port = 5601
   }
   ledger-api-user = "bob_validator_user"
diff --git a/apps/app/src/test/resources/include/validators/splitwell-validator.conf b/apps/app/src/test/resources/include/validators/splitwell-validator.conf
index fabcaf5f133..976545685c2 100644
--- a/apps/app/src/test/resources/include/validators/splitwell-validator.conf
+++ b/apps/app/src/test/resources/include/validators/splitwell-validator.conf
@@ -3,7 +3,7 @@
 
   admin-api.port = 5703
   participant-client = {
-    admin-api.port = 5702
+    admin-api.client-config.port = 5702
     ledger-api.client-config.port = 5701
   }
   ledger-api-user = "splitwell_validator_user"
diff --git a/apps/app/src/test/resources/include/validators/sv1-validator.conf b/apps/app/src/test/resources/include/validators/sv1-validator.conf
index 8e7f81ba882..2952e322686 100644
--- a/apps/app/src/test/resources/include/validators/sv1-validator.conf
+++ b/apps/app/src/test/resources/include/validators/sv1-validator.conf
@@ -3,7 +3,7 @@
 
   admin-api.port = 5103
   participant-client = {
-    admin-api.port = 5102
+    admin-api.client-config.port = 5102
     ledger-api.client-config.port = 5101
   }
   ledger-api-user = "sv1_validator_user"
diff --git a/apps/app/src/test/resources/include/validators/sv2-validator.conf b/apps/app/src/test/resources/include/validators/sv2-validator.conf
index aa347c7217b..f880c0c37cb 100644
--- a/apps/app/src/test/resources/include/validators/sv2-validator.conf
+++ b/apps/app/src/test/resources/include/validators/sv2-validator.conf
@@ -3,7 +3,7 @@
 
   admin-api.port = 5203
   participant-client = {
-    admin-api.port = 5202
+    admin-api.client-config.port = 5202
     ledger-api.client-config.port = 5201
   }
   ledger-api-user = "sv2_validator_user"
diff --git a/apps/app/src/test/resources/include/validators/sv3-validator.conf b/apps/app/src/test/resources/include/validators/sv3-validator.conf
index 6849971f813..8649d2d6fa6 100644
--- a/apps/app/src/test/resources/include/validators/sv3-validator.conf
+++ b/apps/app/src/test/resources/include/validators/sv3-validator.conf
@@ -3,7 +3,7 @@
 
   admin-api.port = 5303
   participant-client = {
-    admin-api.port = 5302
+    admin-api.client-config.port = 5302
     ledger-api.client-config.port = 5301
   }
   ledger-api-user = "sv3_validator_user"
diff --git a/apps/app/src/test/resources/include/validators/sv4-validator.conf b/apps/app/src/test/resources/include/validators/sv4-validator.conf
index 85b9df230ee..8d04385c584 100644
--- a/apps/app/src/test/resources/include/validators/sv4-validator.conf
+++ b/apps/app/src/test/resources/include/validators/sv4-validator.conf
@@ -3,7 +3,7 @@
 
   admin-api.port = 5403
   participant-client = {
-    admin-api.port = 5402
+    admin-api.client-config.port = 5402
     ledger-api.client-config.port = 5401
   }
   ledger-api-user = "sv4_validator_user"
diff --git a/apps/app/src/test/resources/local-sv-node/scan-app/app.conf b/apps/app/src/test/resources/local-sv-node/scan-app/app.conf
index 694ef13bf35..56fca6cacea 100644
--- a/apps/app/src/test/resources/local-sv-node/scan-app/app.conf
+++ b/apps/app/src/test/resources/local-sv-node/scan-app/app.conf
@@ -1,9 +1,10 @@
 include required("../../include/storage-postgres.conf")
 _scan_participant_client {
-  admin-api = {
+  admin-api.client-config = {
     address = "0.0.0.0"
     port = 9102
   }
+  admin-api.auth-config.type = "none"
 
   ledger-api.client-config = {
     address = "0.0.0.0"
diff --git a/apps/app/src/test/resources/local-sv-node/sv-app/app.conf b/apps/app/src/test/resources/local-sv-node/sv-app/app.conf
index e4f0b8d3b69..00fc487e2b2 100644
--- a/apps/app/src/test/resources/local-sv-node/sv-app/app.conf
+++ b/apps/app/src/test/resources/local-sv-node/sv-app/app.conf
@@ -11,7 +11,8 @@ _sv {
   }
 
   participant-client = {
-    admin-api.port = 9102
+    admin-api.client-config.port = 9102
+    admin-api.auth-config.type = "none"
     ledger-api.client-config.port = 9101
     ledger-api.auth-config.type = "none"
   }
diff --git a/apps/app/src/test/resources/local-sv-node/validator-app/app.conf b/apps/app/src/test/resources/local-sv-node/validator-app/app.conf
index 9fc52020196..670c610ed2c 100644
--- a/apps/app/src/test/resources/local-sv-node/validator-app/app.conf
+++ b/apps/app/src/test/resources/local-sv-node/validator-app/app.conf
@@ -13,7 +13,8 @@ canton {
 
       admin-api.port = 5103
       participant-client = {
-        admin-api.port = 9102
+        admin-api.client-config.port = 9102
+        admin-api.auth-config.type = "none"
         ledger-api.client-config.port = 9101
         ledger-api.auth-config.type = "none"
       }
diff --git a/apps/app/src/test/resources/local-validator-node/validator-app/app.conf b/apps/app/src/test/resources/local-validator-node/validator-app/app.conf
index a93158fa7af..c44482af170 100644
--- a/apps/app/src/test/resources/local-validator-node/validator-app/app.conf
+++ b/apps/app/src/test/resources/local-validator-node/validator-app/app.conf
@@ -13,7 +13,8 @@ canton {
 
       admin-api.port = 5503
       participant-client = {
-        admin-api.port = 27502
+        admin-api.client-config.port = 27502
+        admin-api.auth-config.type = "none"
         ledger-api.client-config.port = 27501
         ledger-api.auth-config.type = "none"
       }
diff --git a/apps/app/src/test/resources/preflight-topology.conf b/apps/app/src/test/resources/preflight-topology.conf
index aa0cf99ed91..5a1cbf50c9b 100644
--- a/apps/app/src/test/resources/preflight-topology.conf
+++ b/apps/app/src/test/resources/preflight-topology.conf
@@ -77,7 +77,7 @@ canton {
 
             # unused configuration
             participant-client {
-                admin-api.port = 0
+                admin-api.client-config.port = 0
                 ledger-api {
                     client-config.port = 0
                     auth-config {
diff --git a/apps/app/src/test/scala/org/lfdecentralizedtrust/splice/integration/tests/LocalNetFrontendIntegrationTest.scala b/apps/app/src/test/scala/org/lfdecentralizedtrust/splice/integration/tests/LocalNetFrontendIntegrationTest.scala
index f0a766049b9..ca662a1089b 100644
--- a/apps/app/src/test/scala/org/lfdecentralizedtrust/splice/integration/tests/LocalNetFrontendIntegrationTest.scala
+++ b/apps/app/src/test/scala/org/lfdecentralizedtrust/splice/integration/tests/LocalNetFrontendIntegrationTest.scala
@@ -200,7 +200,7 @@ class LocalNetFrontendIntegrationTest
       val participantClient = new ParticipantClientReference(
         env,
         appProviderParticipant.name,
-        appProviderParticipant.config.copy(token = Some(token)),
+        appProviderParticipant.config.copy(ledgerApiToken = Some(token)),
       )
       participantClient.synchronizers
         .list_connected()
diff --git a/apps/app/src/test/scala/org/lfdecentralizedtrust/splice/integration/tests/LocalNetReassignIntegrationTest.scala b/apps/app/src/test/scala/org/lfdecentralizedtrust/splice/integration/tests/LocalNetReassignIntegrationTest.scala
index 39c9e1560ce..4e410820e71 100644
--- a/apps/app/src/test/scala/org/lfdecentralizedtrust/splice/integration/tests/LocalNetReassignIntegrationTest.scala
+++ b/apps/app/src/test/scala/org/lfdecentralizedtrust/splice/integration/tests/LocalNetReassignIntegrationTest.scala
@@ -80,7 +80,7 @@ class LocalNetReassignIntegrationTest extends IntegrationTestWithIsolatedEnviron
     new ParticipantClientReference(
       env,
       remoteParticipant.name,
-      remoteParticipant.config.copy(token = Some(token)),
+      remoteParticipant.config.copy(ledgerApiToken = Some(token)),
     )
   }
 
diff --git a/apps/app/src/test/scala/org/lfdecentralizedtrust/splice/integration/tests/ManualStartIntegrationTest.scala b/apps/app/src/test/scala/org/lfdecentralizedtrust/splice/integration/tests/ManualStartIntegrationTest.scala
index 5581cc0f445..4e0e1dea5cc 100644
--- a/apps/app/src/test/scala/org/lfdecentralizedtrust/splice/integration/tests/ManualStartIntegrationTest.scala
+++ b/apps/app/src/test/scala/org/lfdecentralizedtrust/splice/integration/tests/ManualStartIntegrationTest.scala
@@ -15,6 +15,7 @@ import com.digitalasset.canton.topology.{
   SequencerId,
   UniqueIdentifier,
 }
+import org.lfdecentralizedtrust.splice.auth.{AuthToken, AuthUtil}
 import org.lfdecentralizedtrust.splice.config.{ConfigTransforms, PruningConfig, SpliceBackendConfig}
 import org.lfdecentralizedtrust.splice.console.AppBackendReference
 import org.lfdecentralizedtrust.splice.environment.*
@@ -29,6 +30,7 @@ import org.lfdecentralizedtrust.splice.sv.config.SvOnboardingConfig.FoundDso
 import org.lfdecentralizedtrust.splice.util.{StandaloneCanton, TriggerTestUtil, WalletTestUtil}
 
 import java.util.UUID
+import scala.concurrent.Future
 import scala.concurrent.duration.DurationInt
 
 class ManualStartIntegrationTest
@@ -422,11 +424,22 @@ class ManualStartIntegrationTest
     import env.executionContext
     val loggerFactoryWithKey = loggerFactory.append("participant", name)
     new ParticipantAdminConnection(
-      FullClientConfig(port = config.participantClient.adminApi.port),
+      FullClientConfig(port = config.participantClient.adminApi.clientConfig.port),
       env.environment.config.monitoring.logging.api,
       loggerFactoryWithKey,
       grpcClientMetrics,
       retryProvider,
+      getToken = () =>
+        Future.successful(
+          Some(
+            AuthToken(
+              AuthUtil.CantonAdminApi.testToken(
+                secret = "test",
+                scope = "test-scope",
+              )
+            )
+          )
+        ),
     )
   }
 }
diff --git a/apps/app/src/test/scala/org/lfdecentralizedtrust/splice/integration/tests/SequencerPruningIntegrationTest.scala b/apps/app/src/test/scala/org/lfdecentralizedtrust/splice/integration/tests/SequencerPruningIntegrationTest.scala
index d40c9f88b57..7ce0627c3d9 100644
--- a/apps/app/src/test/scala/org/lfdecentralizedtrust/splice/integration/tests/SequencerPruningIntegrationTest.scala
+++ b/apps/app/src/test/scala/org/lfdecentralizedtrust/splice/integration/tests/SequencerPruningIntegrationTest.scala
@@ -1,6 +1,6 @@
 package org.lfdecentralizedtrust.splice.integration.tests
 
-import com.digitalasset.canton.config.{FullClientConfig, NonNegativeFiniteDuration}
+import com.digitalasset.canton.config.NonNegativeFiniteDuration
 import com.digitalasset.canton.config.CantonRequireTypes.InstanceName
 import com.digitalasset.canton.config.RequireTypes.Port
 import com.digitalasset.canton.logging.SuppressionRule
@@ -60,7 +60,12 @@ class SequencerPruningIntegrationTest
                 bobValidatorConfig
                   .copy(
                     participantClient = ParticipantClientConfig(
-                      FullClientConfig(port = Port.tryCreate(5902)),
+                      bobValidatorConfig.participantClient.adminApi.copy(
+                        clientConfig =
+                          bobValidatorConfig.participantClient.adminApi.clientConfig.copy(
+                            port = Port.tryCreate(5902)
+                          )
+                      ),
                       bobValidatorConfig.participantClient.ledgerApi.copy(
                         clientConfig =
                           bobValidatorConfig.participantClient.ledgerApi.clientConfig.copy(
diff --git a/apps/app/src/test/scala/org/lfdecentralizedtrust/splice/integration/tests/SvReonboardingIntegrationTest.scala b/apps/app/src/test/scala/org/lfdecentralizedtrust/splice/integration/tests/SvReonboardingIntegrationTest.scala
index a25eeccf8e5..d7efb9a6f15 100644
--- a/apps/app/src/test/scala/org/lfdecentralizedtrust/splice/integration/tests/SvReonboardingIntegrationTest.scala
+++ b/apps/app/src/test/scala/org/lfdecentralizedtrust/splice/integration/tests/SvReonboardingIntegrationTest.scala
@@ -1,7 +1,7 @@
 package org.lfdecentralizedtrust.splice.integration.tests
 
 import com.digitalasset.canton.admin.api.client.data.{NodeStatus, WaitingForId}
-import com.digitalasset.canton.config.{DbConfig, FullClientConfig}
+import com.digitalasset.canton.config.DbConfig
 import com.digitalasset.canton.config.CantonRequireTypes.InstanceName
 import com.digitalasset.canton.config.RequireTypes.{Port, PositiveInt}
 import com.digitalasset.canton.data.CantonTimestamp
@@ -143,7 +143,12 @@ class SvReonboardingIntegrationTest
                     adminApi = referenceValidatorConfig.adminApi
                       .copy(internalPort = Some(Port.tryCreate(27503))),
                     participantClient = ParticipantClientConfig(
-                      FullClientConfig(port = Port.tryCreate(27502)),
+                      referenceValidatorConfig.participantClient.adminApi.copy(
+                        clientConfig =
+                          referenceValidatorConfig.participantClient.adminApi.clientConfig.copy(
+                            port = Port.tryCreate(27502)
+                          )
+                      ),
                       referenceValidatorConfig.participantClient.ledgerApi.copy(
                         clientConfig =
                           referenceValidatorConfig.participantClient.ledgerApi.clientConfig.copy(
diff --git a/apps/app/src/test/scala/org/lfdecentralizedtrust/splice/integration/tests/ValidatorReonboardingIntegrationTest.scala b/apps/app/src/test/scala/org/lfdecentralizedtrust/splice/integration/tests/ValidatorReonboardingIntegrationTest.scala
index 821e3af09c3..71e5687187f 100644
--- a/apps/app/src/test/scala/org/lfdecentralizedtrust/splice/integration/tests/ValidatorReonboardingIntegrationTest.scala
+++ b/apps/app/src/test/scala/org/lfdecentralizedtrust/splice/integration/tests/ValidatorReonboardingIntegrationTest.scala
@@ -2,7 +2,7 @@ package org.lfdecentralizedtrust.splice.integration.tests
 
 import com.digitalasset.canton.config.CantonRequireTypes.InstanceName
 import com.digitalasset.canton.config.RequireTypes.Port
-import com.digitalasset.canton.config.{DbConfig, FullClientConfig}
+import com.digitalasset.canton.config.DbConfig
 import com.digitalasset.canton.data.CantonTimestamp
 import com.digitalasset.canton.logging.SuppressionRule
 import com.digitalasset.canton.topology.{ForceFlag, ParticipantId, PartyId}
@@ -102,7 +102,12 @@ trait ValidatorReonboardingIntegrationTestBase
                 )
               ),
               participantClient = ParticipantClientConfig(
-                FullClientConfig(port = Port.tryCreate(27502)),
+                defaultAliceValidatorConfig.participantClient.adminApi.copy(
+                  clientConfig =
+                    defaultAliceValidatorConfig.participantClient.adminApi.clientConfig.copy(
+                      port = Port.tryCreate(27502)
+                    )
+                ),
                 defaultAliceValidatorConfig.participantClient.ledgerApi.copy(
                   clientConfig =
                     defaultAliceValidatorConfig.participantClient.ledgerApi.clientConfig.copy(
diff --git a/apps/common/src/main/scala/org/lfdecentralizedtrust/splice/auth/AuthUtil.scala b/apps/common/src/main/scala/org/lfdecentralizedtrust/splice/auth/AuthUtil.scala
index 5bb8232156c..c7f9a1f93b5 100644
--- a/apps/common/src/main/scala/org/lfdecentralizedtrust/splice/auth/AuthUtil.scala
+++ b/apps/common/src/main/scala/org/lfdecentralizedtrust/splice/auth/AuthUtil.scala
@@ -5,6 +5,7 @@ package org.lfdecentralizedtrust.splice.auth
 
 import com.auth0.jwt.JWT
 import com.auth0.jwt.algorithms.Algorithm
+import com.digitalasset.canton.participant.ledger.api.JwtTokenUtilities
 
 // See also: com.daml.ledger.api.auth.Main from the Daml SDK contains utils for generating ledger API access tokens
 object AuthUtil {
@@ -66,6 +67,18 @@ object AuthUtil {
     }
   }
 
+  object CantonAdminApi {
+
+    def testToken(
+        secret: String,
+        scope: String,
+    ): String =
+      JwtTokenUtilities.buildUnsafeToken(
+        secret = secret,
+        scope = Some(scope),
+      )
+  }
+
   @SuppressWarnings(Array("org.lfdecentralizedtrust.splice.wart.Println"))
   def main(args: Array[String]): Unit = {
     println(testToken(args(0), args(1), testSecret))
diff --git a/apps/common/src/main/scala/org/lfdecentralizedtrust/splice/config/CNRemoteParticipantConfig.scala b/apps/common/src/main/scala/org/lfdecentralizedtrust/splice/config/CNRemoteParticipantConfig.scala
index 706f9a3e967..d47b7196fdf 100644
--- a/apps/common/src/main/scala/org/lfdecentralizedtrust/splice/config/CNRemoteParticipantConfig.scala
+++ b/apps/common/src/main/scala/org/lfdecentralizedtrust/splice/config/CNRemoteParticipantConfig.scala
@@ -6,18 +6,20 @@ package org.lfdecentralizedtrust.splice.config
 import com.digitalasset.canton.config.FullClientConfig
 import com.digitalasset.canton.participant.config.{BaseParticipantConfig, RemoteParticipantConfig}
 
-abstract class BaseParticipantClientConfig(
-    val adminApi: FullClientConfig,
-    val ledgerApi: LedgerApiClientConfig,
-) extends BaseParticipantConfig {
-  override def clientAdminApi: FullClientConfig = adminApi
+trait BaseParticipantClientConfig extends BaseParticipantConfig {
+
+  def adminApi: ClientConfigWithAuth
+  def ledgerApi: ClientConfigWithAuth
+
+  override def clientAdminApi: FullClientConfig = adminApi.clientConfig
   override def clientLedgerApi: FullClientConfig = ledgerApi.clientConfig
 
   def participantClientConfigWithAdminToken: RemoteParticipantConfig =
     RemoteParticipantConfig(
-      adminApi,
+      adminApi.clientConfig,
       ledgerApi.clientConfig,
-      token = ledgerApi.authConfig.adminToken,
+      ledgerApiToken = ledgerApi.authConfig.adminToken,
+      adminApiToken = adminApi.authConfig.adminToken,
     )
 }
 
@@ -27,6 +29,6 @@ abstract class BaseParticipantClientConfig(
   * @param ledgerApi the configuration to connect the console to the remote ledger api
   */
 case class ParticipantClientConfig(
-    override val adminApi: FullClientConfig,
-    override val ledgerApi: LedgerApiClientConfig,
-) extends BaseParticipantClientConfig(adminApi, ledgerApi)
+    override val adminApi: ClientConfigWithAuth,
+    override val ledgerApi: ClientConfigWithAuth,
+) extends BaseParticipantClientConfig
diff --git a/apps/common/src/main/scala/org/lfdecentralizedtrust/splice/config/LedgerApiClientConfig.scala b/apps/common/src/main/scala/org/lfdecentralizedtrust/splice/config/ClientConfigWithAuth.scala
similarity index 92%
rename from apps/common/src/main/scala/org/lfdecentralizedtrust/splice/config/LedgerApiClientConfig.scala
rename to apps/common/src/main/scala/org/lfdecentralizedtrust/splice/config/ClientConfigWithAuth.scala
index 10fe09d8f95..c03db84a50f 100644
--- a/apps/common/src/main/scala/org/lfdecentralizedtrust/splice/config/LedgerApiClientConfig.scala
+++ b/apps/common/src/main/scala/org/lfdecentralizedtrust/splice/config/ClientConfigWithAuth.scala
@@ -8,7 +8,7 @@ import com.digitalasset.canton.config.FullClientConfig
 /** @param clientConfig Connection parameters
   * @param authConfig Auth tokens used by the app
   */
-case class LedgerApiClientConfig(
+case class ClientConfigWithAuth(
     clientConfig: FullClientConfig,
     authConfig: AuthTokenSourceConfig,
 )
diff --git a/apps/common/src/main/scala/org/lfdecentralizedtrust/splice/environment/AppConnection.scala b/apps/common/src/main/scala/org/lfdecentralizedtrust/splice/environment/AppConnection.scala
index 93651add2dd..5b4bb3493ad 100644
--- a/apps/common/src/main/scala/org/lfdecentralizedtrust/splice/environment/AppConnection.scala
+++ b/apps/common/src/main/scala/org/lfdecentralizedtrust/splice/environment/AppConnection.scala
@@ -4,6 +4,7 @@
 package org.lfdecentralizedtrust.splice.environment
 
 import cats.data.EitherT
+import com.daml.grpc.AuthCallCredentials
 import org.lfdecentralizedtrust.splice.admin.api.client.TraceContextPropagation.*
 import org.lfdecentralizedtrust.splice.admin.api.client.commands.HttpCommand
 import org.lfdecentralizedtrust.splice.admin.api.client.{
@@ -34,11 +35,12 @@ import com.digitalasset.canton.tracing.{TraceContext, TraceContextGrpc}
 import com.digitalasset.canton.util.EitherTUtil
 import com.digitalasset.canton.util.ShowUtil.*
 import io.circe.Json
-import io.grpc.{CallCredentials, Deadline, Status}
+import io.grpc.{Deadline, Status}
 import org.apache.pekko.http.scaladsl.model.{HttpHeader, HttpResponse, MediaTypes, StatusCode, Uri}
 import org.apache.pekko.http.scaladsl.unmarshalling.Unmarshal
 import org.apache.pekko.stream.Materializer
 import org.apache.pekko.util.ByteString
+import org.lfdecentralizedtrust.splice.auth.AuthToken
 
 import scala.concurrent.duration.FiniteDuration
 import scala.concurrent.{ExecutionContext, ExecutionContextExecutor, Future}
@@ -173,6 +175,7 @@ abstract class AppConnection(
     apiLoggingConfig: ApiLoggingConfig,
     override val loggerFactory: NamedLoggerFactory,
     grpcClientMetrics: GrpcClientMetrics,
+    getToken: () => Future[Option[AuthToken]], // TODO: check AuthTokenSource
 )(implicit ec: ExecutionContextExecutor)
     extends BaseAppConnection(loggerFactory)
     with FlagCloseableAsync
@@ -196,7 +199,6 @@ abstract class AppConnection(
   // instead of turning everything into a String.
   protected def runCmd[Req, Res, Result](
       cmd: GrpcAdminCommand[Req, Res, Result],
-      credentials: Option[CallCredentials] = None,
       timeoutOverride: Option[TimeoutType] = None,
   )(implicit traceContext: TraceContext): Future[Result] = {
     val dso =
@@ -210,28 +212,27 @@ abstract class AppConnection(
           new GrpcMetricsClientInterceptor(grpcClientMetrics),
         )
 
-    val dsoAuth = credentials match {
-      case Some(creds) => dso.withCallCredentials(creds)
-      case None => dso
-    }
-
-    val timeout = timeoutOverride.getOrElse(cmd.timeoutType) match {
-      case ServerEnforcedTimeout =>
-        None
-      case CustomClientTimeout(timeout) =>
-        Some(timeout)
-      case DefaultBoundedTimeout =>
-        Some(timeouts.default)
-      case DefaultUnboundedTimeout =>
-        Some(timeouts.unbounded)
-    }
-    val withDeadline = timeout.map(_.duration) match {
-      case Some(finite: FiniteDuration) =>
-        dsoAuth.withDeadline(Deadline.after(finite.length, finite.unit))
-      case _ => dsoAuth
-    }
-
     for {
+      maybeToken <- getToken()
+      dsoAuth = maybeToken match {
+        case Some(token) => dso.withCallCredentials(new AuthCallCredentials(token.accessToken))
+        case None => dso
+      }
+      timeout = timeoutOverride.getOrElse(cmd.timeoutType) match {
+        case ServerEnforcedTimeout =>
+          None
+        case CustomClientTimeout(timeout) =>
+          Some(timeout)
+        case DefaultBoundedTimeout =>
+          Some(timeouts.default)
+        case DefaultUnboundedTimeout =>
+          Some(timeouts.unbounded)
+      }
+      withDeadline = timeout.map(_.duration) match {
+        case Some(finite: FiniteDuration) =>
+          dsoAuth.withDeadline(Deadline.after(finite.length, finite.unit))
+        case _ => dsoAuth
+      }
       req <- toFuture(cmd.createRequestInternal())
       response <- TraceContextGrpc.withGrpcContext(traceContext)(
         cmd.submitRequestInternal(withDeadline, req)
diff --git a/apps/common/src/main/scala/org/lfdecentralizedtrust/splice/environment/NodeBase.scala b/apps/common/src/main/scala/org/lfdecentralizedtrust/splice/environment/NodeBase.scala
index db17dff4735..041f9b7e6b3 100644
--- a/apps/common/src/main/scala/org/lfdecentralizedtrust/splice/environment/NodeBase.scala
+++ b/apps/common/src/main/scala/org/lfdecentralizedtrust/splice/environment/NodeBase.scala
@@ -139,27 +139,7 @@ abstract class NodeBase[State <: AutoCloseable & HasHealth](
       loggerFactory,
     )
   } yield {
-    // AuthTokenSourceNone source does not work with AuthTokenManager which re-requests on None result
-    val getToken: () => Future[Option[AuthToken]] =
-      authTokenSource match {
-        case none: AuthTokenSourceNone => () => none.getToken
-        case other =>
-          val clock = new WallClock(timeouts, loggerFactory)
-          val authTokenManager = new AuthTokenManager(
-            () => other.getToken,
-            this.isClosing,
-            clock,
-            loggerFactory,
-          )
-          () =>
-            retryProvider.retry(
-              RetryFor.WaitingOnInitDependency,
-              "acquire_auth_token",
-              "Acquiring auth token",
-              authTokenManager.getToken,
-              logger,
-            )
-      }
+    val getToken = createTokenProvider(authTokenSource)
     new SpliceLedgerClient(
       participantClient.ledgerApi.clientConfig,
       // Note: When ledger API auth is enabled, application ID must be equal to user ID
@@ -337,6 +317,49 @@ abstract class NodeBase[State <: AutoCloseable & HasHealth](
       )
     }
   }
+
+  protected def createParticipantAdminConnection()(implicit
+      tc: TraceContext
+  ): ParticipantAdminConnection = {
+    val tokenSource = AuthTokenSource.fromConfig(
+      participantClient.adminApi.authConfig,
+      nodeMetrics.httpClientMetrics,
+      loggerFactory,
+    )
+    val tokenProvider = createTokenProvider(tokenSource)
+    new ParticipantAdminConnection(
+      participantClient.adminApi.clientConfig,
+      parameters.loggingConfig.api,
+      loggerFactory,
+      nodeMetrics.grpcClientMetrics,
+      retryProvider,
+      tokenProvider,
+    )
+  }
+
+  private def createTokenProvider(
+      tokenSource: AuthTokenSource
+  )(implicit tc: TraceContext): () => Future[Option[AuthToken]] =
+    tokenSource match {
+      // AuthTokenSourceNone source does not work with AuthTokenManager which re-requests on None result
+      case none: AuthTokenSourceNone => () => none.getToken
+      case other =>
+        val clock = new WallClock(timeouts, loggerFactory)
+        val authTokenManager = new AuthTokenManager(
+          () => other.getToken,
+          this.isClosing,
+          clock,
+          loggerFactory,
+        )
+        () =>
+          retryProvider.retry(
+            RetryFor.WaitingOnInitDependency,
+            "acquire_auth_token",
+            "Acquiring auth token",
+            authTokenManager.getToken,
+            logger,
+          )
+    }
 }
 
 object NodeBase {
diff --git a/apps/common/src/main/scala/org/lfdecentralizedtrust/splice/environment/ParticipantAdminConnection.scala b/apps/common/src/main/scala/org/lfdecentralizedtrust/splice/environment/ParticipantAdminConnection.scala
index b6f95f51934..ddcd2695bed 100644
--- a/apps/common/src/main/scala/org/lfdecentralizedtrust/splice/environment/ParticipantAdminConnection.scala
+++ b/apps/common/src/main/scala/org/lfdecentralizedtrust/splice/environment/ParticipantAdminConnection.scala
@@ -55,6 +55,7 @@ import com.google.protobuf.ByteString
 import io.grpc.{Status, StatusRuntimeException}
 import io.opentelemetry.api.trace.Tracer
 import org.lfdecentralizedtrust.splice.admin.api.client.GrpcClientMetrics
+import org.lfdecentralizedtrust.splice.auth.AuthToken
 import org.lfdecentralizedtrust.splice.config.Thresholds
 import org.lfdecentralizedtrust.splice.environment.ParticipantAdminConnection.{
   HasParticipantId,
@@ -79,6 +80,7 @@ class ParticipantAdminConnection(
     loggerFactory: NamedLoggerFactory,
     grpcClientMetrics: GrpcClientMetrics,
     retryProvider: RetryProvider,
+    getToken: () => Future[Option[AuthToken]],
 )(implicit protected val ec: ExecutionContextExecutor, tracer: Tracer)
     extends TopologyAdminConnection(
       config,
@@ -86,6 +88,7 @@ class ParticipantAdminConnection(
       loggerFactory,
       grpcClientMetrics,
       retryProvider,
+      getToken,
     )
     with HasParticipantId
     with ParticipantAdminDarsConnection
diff --git a/apps/common/src/main/scala/org/lfdecentralizedtrust/splice/environment/TopologyAdminConnection.scala b/apps/common/src/main/scala/org/lfdecentralizedtrust/splice/environment/TopologyAdminConnection.scala
index 468e8afe7a5..ee1e7296565 100644
--- a/apps/common/src/main/scala/org/lfdecentralizedtrust/splice/environment/TopologyAdminConnection.scala
+++ b/apps/common/src/main/scala/org/lfdecentralizedtrust/splice/environment/TopologyAdminConnection.scala
@@ -59,6 +59,7 @@ import com.google.protobuf.ByteString
 import io.grpc.{Status, StatusRuntimeException}
 import io.opentelemetry.api.trace.Tracer
 import org.lfdecentralizedtrust.splice.admin.api.client.GrpcClientMetrics
+import org.lfdecentralizedtrust.splice.auth.AuthToken
 import org.lfdecentralizedtrust.splice.config.Thresholds
 import org.lfdecentralizedtrust.splice.environment.RetryProvider.QuietNonRetryableException
 import org.lfdecentralizedtrust.splice.environment.TopologyAdminConnection.{
@@ -84,12 +85,14 @@ abstract class TopologyAdminConnection(
     loggerFactory: NamedLoggerFactory,
     grpcClientMetrics: GrpcClientMetrics,
     override protected[this] val retryProvider: RetryProvider,
+    getToken: () => Future[Option[AuthToken]] = () => Future.successful(None),
 )(implicit ec: ExecutionContextExecutor, tracer: Tracer)
     extends AppConnection(
       config,
       apiLoggingConfig,
       loggerFactory,
       grpcClientMetrics,
+      getToken,
     )
     with RetryProvider.Has
     with LsuTopologyAdminConnection
diff --git a/apps/scan/src/main/scala/org/lfdecentralizedtrust/splice/scan/ScanApp.scala b/apps/scan/src/main/scala/org/lfdecentralizedtrust/splice/scan/ScanApp.scala
index 7b704c252f4..7833e6a16dd 100644
--- a/apps/scan/src/main/scala/org/lfdecentralizedtrust/splice/scan/ScanApp.scala
+++ b/apps/scan/src/main/scala/org/lfdecentralizedtrust/splice/scan/ScanApp.scala
@@ -186,13 +186,7 @@ class ScanApp(
         appInitConnection.getInitialRoundFromUserMetadata(config.svUser)
       }
       _ = logger.debug(s"Started with initial round $initialRound")
-      participantAdminConnection = new ParticipantAdminConnection(
-        config.participantClient.adminApi,
-        amuletAppParameters.loggingConfig.api,
-        loggerFactory,
-        scanAppMetrics.grpcClientMetrics,
-        retryProvider,
-      )
+      participantAdminConnection = createParticipantAdminConnection()
       participantId <- appInitStep("Get participant id") {
         participantAdminConnection.getParticipantId()
       }
diff --git a/apps/splitwell/src/main/scala/org/lfdecentralizedtrust/splice/splitwell/SplitwellApp.scala b/apps/splitwell/src/main/scala/org/lfdecentralizedtrust/splice/splitwell/SplitwellApp.scala
index 1847051d96a..f8712cf099a 100644
--- a/apps/splitwell/src/main/scala/org/lfdecentralizedtrust/splice/splitwell/SplitwellApp.scala
+++ b/apps/splitwell/src/main/scala/org/lfdecentralizedtrust/splice/splitwell/SplitwellApp.scala
@@ -105,13 +105,7 @@ class SplitwellApp(
         loggerFactory,
       )
     }
-    participantAdminConnection = new ParticipantAdminConnection(
-      config.participantClient.adminApi,
-      amuletAppParameters.loggingConfig.api,
-      loggerFactory,
-      metrics.grpcClientMetrics,
-      retryProvider,
-    )
+    participantAdminConnection = createParticipantAdminConnection()
     participantId <- appInitStep("Get participant id") {
       participantAdminConnection.getParticipantId()
     }
diff --git a/apps/sv/src/main/scala/org/lfdecentralizedtrust/splice/sv/SvApp.scala b/apps/sv/src/main/scala/org/lfdecentralizedtrust/splice/sv/SvApp.scala
index 103a14ce77c..61347e2118d 100644
--- a/apps/sv/src/main/scala/org/lfdecentralizedtrust/splice/sv/SvApp.scala
+++ b/apps/sv/src/main/scala/org/lfdecentralizedtrust/splice/sv/SvApp.scala
@@ -121,13 +121,7 @@ class SvApp(
     super.packagesForJsonDecoding ++ DarResources.dsoGovernance.all ++ DarResources.validatorLifecycle.all ++ DarResources.amuletNameService.all
 
   override def preInitializeBeforeLedgerConnection()(implicit tc: TraceContext): Future[Unit] = {
-    val participantAdminConnection = new ParticipantAdminConnection(
-      config.participantClient.adminApi,
-      amuletAppParameters.loggingConfig.api,
-      loggerFactory,
-      metrics.grpcClientMetrics,
-      retryProvider,
-    )
+    val participantAdminConnection = createParticipantAdminConnection()
     (for {
       _ <-
         appInitStep("Ensure participant is initialized with expected id") {
@@ -151,13 +145,7 @@ class SvApp(
   override def initializeNode(
       ledgerClient: SpliceLedgerClient
   )(implicit tc: TraceContext): Future[SvApp.State] = {
-    val participantAdminConnection = new ParticipantAdminConnection(
-      config.participantClient.adminApi,
-      amuletAppParameters.loggingConfig.api,
-      loggerFactory,
-      metrics.grpcClientMetrics,
-      retryProvider,
-    )
+    val participantAdminConnection = createParticipantAdminConnection()
 
     def localSyncNodeFromConfig(svSynchronizerConfig: SvSynchronizerNodeConfig) = {
       CometBftNode(
diff --git a/apps/sv/src/main/scala/org/lfdecentralizedtrust/splice/sv/config/SvAppConfig.scala b/apps/sv/src/main/scala/org/lfdecentralizedtrust/splice/sv/config/SvAppConfig.scala
index 8bf48f6ccb2..177ae1c5e2a 100644
--- a/apps/sv/src/main/scala/org/lfdecentralizedtrust/splice/sv/config/SvAppConfig.scala
+++ b/apps/sv/src/main/scala/org/lfdecentralizedtrust/splice/sv/config/SvAppConfig.scala
@@ -37,7 +37,7 @@ import org.lfdecentralizedtrust.splice.config.{
   BackupDumpConfig,
   BaseParticipantClientConfig,
   GcpBucketConfig,
-  LedgerApiClientConfig,
+  ClientConfigWithAuth,
   ParticipantBootstrapDumpConfig,
   PeriodicBackupDumpConfig,
   PruningConfig,
@@ -335,13 +335,13 @@ final case class BeneficiaryConfig(
 )
 
 final case class SvParticipantClientConfig(
-    override val adminApi: FullClientConfig,
-    override val ledgerApi: LedgerApiClientConfig,
+    override val adminApi: ClientConfigWithAuth,
+    override val ledgerApi: ClientConfigWithAuth,
     sequencerRequestAmplification: SubmissionRequestAmplification =
       SvAppBackendConfig.DefaultParticipantSequencerRequestAmplification,
     sequencerConnectionPoolDelays: SequencerConnectionPoolDelays =
       SequencerConnectionPoolDelays.default,
-) extends BaseParticipantClientConfig(adminApi, ledgerApi)
+) extends BaseParticipantClientConfig
 
 final case class BftSequencingParameters(
     pbftViewChangeTimeout: PositiveFiniteDuration =
diff --git a/apps/validator/src/main/scala/org/lfdecentralizedtrust/splice/validator/ValidatorApp.scala b/apps/validator/src/main/scala/org/lfdecentralizedtrust/splice/validator/ValidatorApp.scala
index 2f922d0ed9e..1205f2abbb1 100644
--- a/apps/validator/src/main/scala/org/lfdecentralizedtrust/splice/validator/ValidatorApp.scala
+++ b/apps/validator/src/main/scala/org/lfdecentralizedtrust/splice/validator/ValidatorApp.scala
@@ -521,14 +521,10 @@ class ValidatorApp(
     )
   }
 
-  private def withParticipantAdminConnection[T](f: ParticipantAdminConnection => Future[T]) = {
-    val participantAdminConnection = new ParticipantAdminConnection(
-      config.participantClient.adminApi,
-      amuletAppParameters.loggingConfig.api,
-      loggerFactory,
-      metrics.grpcClientMetrics,
-      retryProvider,
-    )
+  private def withParticipantAdminConnection[T](
+      f: ParticipantAdminConnection => Future[T]
+  )(implicit traceContext: TraceContext) = {
+    val participantAdminConnection = createParticipantAdminConnection()
     f(participantAdminConnection).andThen { _ => participantAdminConnection.close() }
   }
 
@@ -591,13 +587,7 @@ class ValidatorApp(
           this.getClass.getSimpleName,
           loggerFactory,
         )
-      participantAdminConnection = new ParticipantAdminConnection(
-        config.participantClient.adminApi,
-        amuletAppParameters.loggingConfig.api,
-        loggerFactory,
-        metrics.grpcClientMetrics,
-        retryProvider,
-      )
+      participantAdminConnection = createParticipantAdminConnection()
       participantIdentitiesStore = new NodeIdentitiesStore(
         participantAdminConnection,
         config.participantIdentitiesBackup.map(_ -> clock),
diff --git a/canton/community/app-base/src/main/scala/com/digitalasset/canton/console/InstanceReference.scala b/canton/community/app-base/src/main/scala/com/digitalasset/canton/console/InstanceReference.scala
index c802377877f..fd3b850cb64 100644
--- a/canton/community/app-base/src/main/scala/com/digitalasset/canton/console/InstanceReference.scala
+++ b/canton/community/app-base/src/main/scala/com/digitalasset/canton/console/InstanceReference.scala
@@ -406,6 +406,8 @@ trait RemoteInstanceReference extends InstanceReference {
   override val keys: KeyAdministrationGroup =
     new KeyAdministrationGroup(this, this, consoleEnvironment, loggerFactory)
 
+  def adminApiAdminToken: Option[String]
+
   def config: NodeConfig
 
   override def adminCommand[Result](
@@ -415,7 +417,7 @@ trait RemoteInstanceReference extends InstanceReference {
       name,
       grpcCommand,
       config.clientAdminApi,
-      adminToken,
+      adminApiAdminToken,
     )
 }
 
@@ -712,7 +714,9 @@ class RemoteParticipantReference(environment: ConsoleEnvironment, override val n
     extends ParticipantReference(environment, name)
     with RemoteInstanceReference {
 
-  def adminToken: Option[String] = config.token
+  def adminToken: Option[String] = config.ledgerApiToken
+
+  def adminApiAdminToken: Option[String] = config.adminApiToken
 
   @Help.Summary("Return remote participant config")
   def config: RemoteParticipantConfig =
@@ -725,10 +729,10 @@ class RemoteParticipantReference(environment: ConsoleEnvironment, override val n
       name,
       command,
       config.clientLedgerApi,
-      config.token,
+      config.ledgerApiToken,
     )
 
-  override protected[console] def token: Option[String] = config.token
+  override protected[console] def token: Option[String] = config.ledgerApiToken
 
   private lazy val testing_ = new ParticipantTestingGroup(this, consoleEnvironment, loggerFactory)
 
@@ -1472,6 +1476,8 @@ class RemoteSequencerReference(val environment: ConsoleEnvironment, val name: St
 
   def adminToken: Option[String] = config.token
 
+  def adminApiAdminToken: Option[String] = None
+
   override protected[canton] def executionContext: ExecutionContext =
     consoleEnvironment.environment.executionContext
 
@@ -1608,6 +1614,8 @@ class RemoteMediatorReference(val environment: ConsoleEnvironment, val name: Str
 
   def adminToken: Option[String] = config.token
 
+  def adminApiAdminToken: Option[String] = None
+
   @Help.Summary("Returns the remote mediator configuration")
   def config: RemoteMediatorConfig =
     environment.environment.config.remoteMediatorsByString(name)
diff --git a/canton/community/participant/src/main/scala/com/digitalasset/canton/participant/config/ParticipantNodeConfig.scala b/canton/community/participant/src/main/scala/com/digitalasset/canton/participant/config/ParticipantNodeConfig.scala
index e7d10d1bf5e..9d194ada515 100644
--- a/canton/community/participant/src/main/scala/com/digitalasset/canton/participant/config/ParticipantNodeConfig.scala
+++ b/canton/community/participant/src/main/scala/com/digitalasset/canton/participant/config/ParticipantNodeConfig.scala
@@ -177,7 +177,8 @@ final case class RemoteParticipantConfig(
     adminApi: FullClientConfig,
     ledgerApi: FullClientConfig,
     ledgerJsonApi: Option[JsonClientConfig] = None,
-    token: Option[String] = None,
+    ledgerApiToken: Option[String] = None,
+    adminApiToken: Option[String] = None,
 ) extends BaseParticipantConfig {
   override def clientAdminApi: ClientConfig = adminApi
   override def clientLedgerApi: ClientConfig = ledgerApi
diff --git a/cluster/compose/localnet/conf/splice/app-provider/app.conf b/cluster/compose/localnet/conf/splice/app-provider/app.conf
index 3fb706a4ee7..ba4bbf585f1 100644
--- a/cluster/compose/localnet/conf/splice/app-provider/app.conf
+++ b/cluster/compose/localnet/conf/splice/app-provider/app.conf
@@ -3,7 +3,7 @@ canton.validator-apps.app-provider-validator_backend = ${_validator_backend} {
   storage.config.properties.databaseName = validator-app-provider
   admin-api.port = 3${VALIDATOR_ADMIN_API_PORT_SUFFIX}
   participant-client {
-    admin-api.port = 3${PARTICIPANT_ADMIN_API_PORT_SUFFIX}
+    admin-api.client-config.port = 3${PARTICIPANT_ADMIN_API_PORT_SUFFIX}
     ledger-api.client-config.port = 3${PARTICIPANT_LEDGER_API_PORT_SUFFIX}
   }
   validator-party-hint = ${APP_PROVIDER_PARTY_HINT}
diff --git a/cluster/compose/localnet/conf/splice/app-user/app.conf b/cluster/compose/localnet/conf/splice/app-user/app.conf
index 91f16fea557..bc90a2b2ec3 100644
--- a/cluster/compose/localnet/conf/splice/app-user/app.conf
+++ b/cluster/compose/localnet/conf/splice/app-user/app.conf
@@ -3,7 +3,7 @@ canton.validator-apps.app-user-validator_backend = ${_validator_backend} {
   storage.config.properties.databaseName = validator-app-user
   admin-api.port = 2${VALIDATOR_ADMIN_API_PORT_SUFFIX}
   participant-client {
-    admin-api.port = 2${PARTICIPANT_ADMIN_API_PORT_SUFFIX}
+    admin-api.client-config.port = 2${PARTICIPANT_ADMIN_API_PORT_SUFFIX}
     ledger-api.client-config.port = 2${PARTICIPANT_LEDGER_API_PORT_SUFFIX}
   }
   validator-party-hint = ${APP_USER_PARTY_HINT}
diff --git a/cluster/compose/localnet/conf/splice/app.conf b/cluster/compose/localnet/conf/splice/app.conf
index 2e7cb00f150..aeeac95cc0f 100644
--- a/cluster/compose/localnet/conf/splice/app.conf
+++ b/cluster/compose/localnet/conf/splice/app.conf
@@ -26,7 +26,7 @@ _validator_backend {
     port = 5003
   }
   participant-client = {
-    admin-api = {
+    admin-api.client-config = {
       address = canton
       port = 5002
     }
diff --git a/cluster/images/multi-validator/pre-bootstrap.sh b/cluster/images/multi-validator/pre-bootstrap.sh
index 7f5c0b95058..9e7c229a017 100644
--- a/cluster/images/multi-validator/pre-bootstrap.sh
+++ b/cluster/images/multi-validator/pre-bootstrap.sh
@@ -86,8 +86,10 @@ canton.validator-apps.validator_backend_$index = {
 
     participant-client = {
         admin-api = {
-            address = \${SPLICE_APP_VALIDATOR_PARTICIPANT_ADDRESS}
-            port = $participant_admin_port
+            client-config = {
+                address = \${SPLICE_APP_VALIDATOR_PARTICIPANT_ADDRESS}
+                port = $participant_admin_port
+            }
         }
         ledger-api = {
             client-config = {
diff --git a/cluster/images/scan-app/app.conf b/cluster/images/scan-app/app.conf
index 4f97b09de31..5926df6430c 100644
--- a/cluster/images/scan-app/app.conf
+++ b/cluster/images/scan-app/app.conf
@@ -11,10 +11,11 @@ _client_credentials_auth_config {
 }
 
 _scan_participant_client {
-  admin-api = {
+  admin-api.client-config = {
     address = ${SPLICE_APP_SCAN_PARTICIPANT_ADDRESS}
     port = 5002
   }
+  admin-api.auth-config.type = "none" // TODO
 
   ledger-api.client-config = {
     address = ${SPLICE_APP_SCAN_PARTICIPANT_ADDRESS}
diff --git a/cluster/images/splitwell-app/app.conf b/cluster/images/splitwell-app/app.conf
index 11c5ca4c39f..71dbd79e1c9 100644
--- a/cluster/images/splitwell-app/app.conf
+++ b/cluster/images/splitwell-app/app.conf
@@ -11,8 +11,11 @@ _client_credentials_auth_config {
 
 _participant_client {
   admin-api = {
-    address = ${SPLICE_APP_SPLITWELL_PARTICIPANT_HOST}
-    port = 5002
+    client-config = {
+      address = ${SPLICE_APP_SPLITWELL_PARTICIPANT_HOST}
+      port = 5002
+    }
+    auth-config.type = "none" // TODO
   }
 
   ledger-api = {
diff --git a/cluster/images/sv-app/app.conf b/cluster/images/sv-app/app.conf
index c596d8fd6eb..dbc00cf1d1d 100644
--- a/cluster/images/sv-app/app.conf
+++ b/cluster/images/sv-app/app.conf
@@ -11,10 +11,11 @@ _client_credentials_auth_config {
 }
 
 _sv_participant_client {
-  admin-api = {
+  admin-api.client-config = {
     address = ${SPLICE_APP_SV_PARTICIPANT_ADDRESS}
     port = 5002
   }
+  admin-api.auth-config.type = "none" // TODO
   ledger-api.client-config = {
     address = ${SPLICE_APP_SV_PARTICIPANT_ADDRESS}
     port = 5001
diff --git a/cluster/images/validator-app/app.conf b/cluster/images/validator-app/app.conf
index 01dac35ef1e..d4110696191 100644
--- a/cluster/images/validator-app/app.conf
+++ b/cluster/images/validator-app/app.conf
@@ -28,8 +28,11 @@ canton {
       }
       participant-client = {
         admin-api = {
-          address = ${SPLICE_APP_VALIDATOR_PARTICIPANT_ADDRESS}
-          port = 5002
+          client-config = {
+            address = ${SPLICE_APP_VALIDATOR_PARTICIPANT_ADDRESS}
+            port = 5002
+          }
+          auth-config.type = "none" // TODO
         }
         ledger-api = {
           client-config = {
diff --git a/project/ignore-patterns/canton_log.ignore.txt b/project/ignore-patterns/canton_log.ignore.txt
index 1f179f8657b..5739e9f8266 100644
--- a/project/ignore-patterns/canton_log.ignore.txt
+++ b/project/ignore-patterns/canton_log.ignore.txt
@@ -219,3 +219,6 @@ StateService/GetConnectedSynchronizers.*INTERNAL/Failed retrieving SynchronizerT
 # topology-init download rejection under the test concurrency limit (3); the
 # client retries and succeeds
 SERVER_OVERLOADED.*Reached the limit of concurrent requests for.*DownloadTopologyStateForInit
+
+# Deprecated admin API auth config
+Scope-based tokens have been configured (targetScope is set without a targetAudience). This feature is deprecated in Canton 3.5 and will be removed in version 3.7. Please migrate to audience-based tokens.