> For the complete documentation index, see [llms.txt](https://docs.idlayr.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.idlayr.com/get-started/concepts/credentials.md).

# Credentials

Each project has one OAuth2 credential pair — a `client_id` and a `client_secret` — that your backend uses to obtain access tokens for the IDlayr API.

## OAuth2 client credentials

The credentials are issued when the project is created and are visible in the Enterprise Portal. The `client_secret` is shown once at creation time and not retrievable later. Store it securely; rotate it if compromised.

Use the credentials with the OAuth2 client credentials grant at the token endpoint to obtain a short-lived access token. The access token is what you send on every API call.

## Entitlement tokens for mobile SDKs

Mobile SDKs (iOS, Android) cannot use OAuth2 client credentials directly — the `client_secret` is a backend secret and must never be embedded in a mobile app. Instead, the mobile SDK uses an **entitlement token** that your backend mints on demand from the project's credentials.

Entitlement tokens are short-lived, scoped to one project, and safe to hand to a device.

## Rotation

* Rotate the `client_secret` on a defined schedule. The Enterprise Portal supports rotating without downtime: a new secret can be issued before the old one is revoked.
* Treat the `client_secret` as a workspace-grade secret. Store it in a secrets manager, not in environment files committed to source control.

## Separation by environment

A project has one set of credentials, but the project itself is either production or sandbox (see [Project modes](/get-started/concepts/project-modes.md)). To run both, create two projects — one for sandbox testing, one for production — each with its own credentials.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.idlayr.com/get-started/concepts/credentials.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.