Generating API Credentials

How to generate, manage, and revoke API credentials using API Apps in Dev Tools.

The API Apps section of the Dev Tools page gives you easy access to everything you need to manage credentials for any external apps you want to authorize to use your community's GraphQL API. You can create new credentials, manage existing ones, and download a JSON file for easy integration into your applications.

Info: You can create as many or as few API apps as you need, though the deletion of a Client ID and Client Secret set will immediately revoke access to the GraphQL API for any app(s) that use them.

Create new app credentials

To generate a new set of API credentials, you will need to do the following:

1. Click the Create App button.
2. Fill out the App name and Authorization redirect URL fields with a recognizable name for the app and the redirect URL you would like to set as the callback.
3. Click the Create button.

The Enable Oauth client option gives you the ability to assign a specific authentication role for the API use when processing any requests made using these credentials. The Oauth client credentials auth role dropdown will list any available roles to assign.

Once you have clicked the Create button, a new Client Secret and Client ID will be generated and placed in the list.

Edit a Web App

If you would like to edit an existing API app without breaking the current credentials, you can do so by selecting the Options icon and clicking Edit. An Edit Web App modal will appear, giving you the ability to change the authorization redirect URL and/or Oauth client role for the app.

Download JSON credentials

For easier integration into your apps, we have provided a download option that sends you a credentials.json file including the Client Name, Client Secret, and Client ID.

Delete an API app

If you would like to revoke access to an existing API app, you can delete its credentials from the list by selecting the Options menu for that app and clicking the Delete option.

Once you have confirmed your choice to delete the app, its access to the API is immediately revoked until new credentials are generated and implemented.