diff --git a/lib/services/pax8-factory.ts b/lib/services/pax8-factory.ts
new file mode 100644
index 0000000..342a0fa
--- /dev/null
+++ b/lib/services/pax8-factory.ts
@@ -0,0 +1,25 @@
+import { Pax8Client } from './pax8-client';
+
+let _client: Pax8Client | null = null;
+
+export function isPax8Configured(): boolean {
+  return Boolean(process.env.PAX8_CLIENT_ID && process.env.PAX8_CLIENT_SECRET);
+}
+
+export function getPax8Client(): Pax8Client {
+  if (_client) return _client;
+  if (!isPax8Configured()) {
+    throw new Error('PAX8 is not configured — set PAX8_CLIENT_ID and PAX8_CLIENT_SECRET');
+  }
+  _client = new Pax8Client({
+    clientId: process.env.PAX8_CLIENT_ID!,
+    clientSecret: process.env.PAX8_CLIENT_SECRET!,
+  });
+  console.log('[PAX8] Client initialized');
+  return _client;
+}
+
+// Test seam — reset the cached client (e.g. after rotating credentials).
+export function _resetPax8Client(): void {
+  _client = null;
+}