> For the complete documentation index, see [llms.txt](https://docs.idlayr.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.idlayr.com/enterprise-portal/credentials.md).

# Credentials

A project's **credentials** are the OAuth2 `client_id` / `client_secret` pair your backend uses to mint access tokens against the IDlayr API. They're generated from the Portal and tied to a specific project.

## Generate credentials

1. From the **Projects** page, click the project card.
2. On the project details page, click **Generate Credentials**.
3. Review the generated `Client ID` and `Client secret` in the modal.
4. **Copy or download the credentials** before closing the modal.

{% hint style="danger" %}
**The `client_secret` is shown only once.** After you close the credentials modal, it cannot be retrieved again. If you lose it, you'll need to revoke the credentials and generate a new pair. Copy or download before closing.
{% endhint %}

## Downloaded credentials format

When you click **Download credentials**, the Portal saves a `.json` file with the following shape:

```json
{
  "project_id": "111a1aa1-111a-1111-11aa-a1a111aa1a1a",
  "name": "Project Name",
  "created_at": "2026-03-23T15:03:15.000Z",
  "credentials": [
    {
      "client_id": "2b222222-bb22-22b2-22b2-b2bbb2bb2b22",
      "client_secret": "3333333333333",
      "created_at": "2026-03-23T15:03:15.000Z"
    }
  ],
  "updated_at": "2026-04-08T17:41:50.625Z"
}
```

This is the only time `client_secret` appears in any artefact the Portal produces — store it as a secret in your runtime environment (e.g. a secrets manager, a CI-scoped environment variable) and **do not commit it to source control**.

## Using credentials

Your backend exchanges the `client_id` / `client_secret` for short-lived OAuth2 access tokens at `POST /oauth2/token`:

```bash
curl -X POST https://{data_residency}.api.idlayr.com/oauth2/token \
  -u "{client_id}:{client_secret}" \
  -d "grant_type=client_credentials" \
  -d "scope={product_scope}"
```

The response carries an `access_token` (typically valid for one hour) which you present as a Bearer token on each IDlayr API call. See [Authentication](/get-started/authentication.md) for the full token-lifecycle model.

## Rotation

To rotate a project's credentials:

1. **Generate new credentials.** The new `client_id` / `client_secret` pair appears alongside any existing ones for the project.
2. **Update your runtime secrets** to use the new credentials.
3. **Confirm traffic has cut over** by reviewing recent [verification logs](/enterprise-portal/verification-logs.md).
4. **Revoke the old credentials** from the Portal. Once revoked, the old `client_secret` cannot be used to mint new access tokens.

Rotate on a cadence aligned with your security policy, and immediately if you suspect a `client_secret` has been exposed.

## Revoking credentials

Click **Revoke** next to a credential pair to disable it. The action takes effect immediately:

* Any access token already minted from the revoked credentials will continue to work until it expires (typically up to one hour).
* New access-token requests using the revoked `client_secret` will fail with `401 unauthorized`.

Revocation cannot be undone. If you revoke a credential pair you still need, generate a new pair.

## Security guidance

* **Treat `client_secret` like a database password.** Never expose it to client-side code (web pages, mobile apps), commit it to source control, or include it in published app artefacts.
* **Pass `client_secret` only to your backend at runtime.** Use a secrets manager (HashiCorp Vault, AWS Secrets Manager, GCP Secret Manager, Doppler, 1Password, etc.) or your CI/CD platform's secret store.
* **Rotate periodically.** A typical cadence is every 90–180 days, depending on your security policy.
* **Rotate immediately on incident.** If anyone outside the authorised set ever sees the `client_secret`, revoke and regenerate.

The Cloudsmith **entitlement token** used to download the mobile SDKs is a separate credential — see [SDKs](/get-started/sdks.md) and the tokens-at-a-glance table on that page.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.idlayr.com/enterprise-portal/credentials.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.