---
title: "API Access Management"
slug: "api-access-management"
description: "Manage API access with Unqork's API Access Management. Create and control credentials for secure external system authentication."
tags: ["administration", "api"]
status: "update"
updated: 2026-10-13T15:32:09Z
published: 2026-10-13T15:32:09Z
canonical: "docs.unqork.io/api-access-management"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.unqork.io/llms.txt
> Use this file to discover all available pages before exploring further.

# API Access Management

To access API Access Management, navigate to **Administration** > **Integration** > **API Access Management**.

API Access Management lets administrators create and manage OAuth credentials that let external systems authenticate to the Unqork API programmatically. Unlike user-based authentication, API credentials use a client ID and client secret to authenticate without requiring a logged-in user session.

> [!WARNING]
> Managing API access requires administrative permissions. Administrators needing access should contact their environment administrator.

## Credential List

The page organizes credentials into the following tabs: **Express** and **Creator**. Each tab displays credentials of that type. Both tabs display the same columns. The Express tab displays a **Role(s)** column that supports multiple roles, while the Creator tab displays a single **Role** column.

| Column | Description |
| --- | --- |
| **Name** | A display name for the credential. |
| **Client ID** | The unique identifier used to authenticate API requests. |
| **Created** | The date and time the credential was created. |
| **Expires** | The date the credential expires. |
| **Last Modified** | The date and time the credential was last updated. |
| **Role(s)/Role** | The role or roles assigned to the credential. |
| **Status** | The current state of the credential. See [Credential Statuses](/unqorkai/docs/api-access-management#credential-statuses) for details. |
| **Actions** | Credential-level actions. |

## Adding a Credential

Regardless of the active tab, click **Create New** and choose either **Express Access Credential** or **Creator Access Credential**. The modal opens to the **Credential Details** tab.

### Credential Details

**Express credentials**:

| Setting | Description |
| --- | --- |
| **Name** | A display name for the credential. |
| **Description** | An optional description of the credential's purpose or the system using it. |
| **Role(s)** | The Express roles assigned to the credential. Controls what the credential can access. Multiple roles can be assigned. |
| **Group(s)** | The Express groups assigned to the credential. Multiple groups can be assigned. Optional. |
| **Days to Expiration** | The count of days until the credential expires. Must be greater than 0 and cannot exceed 730. Defaults to 90. |
| **Add Custom Attribute** | Click **Add Custom Attribute** to add a key-value pair to the credential's session when it authenticates. Enter a **Custom Attribute Name** and **Attribute Value** for each. Multiple attributes can be added or removed. Optional. |

**Creator credentials**:

| Setting | Description |
| --- | --- |
| **Name** | A display name for the credential. |
| **Description** | An optional description of the credential's purpose or the system using it. |
| **Role** | The Creator role assigned to the credential. Controls what the credential can access. |
| **Days to Expiration** | The count of days until the credential expires. Must be greater than 0 and cannot exceed 730. Defaults to 90. |
| **Add Custom Attribute** | Click **Add Custom Attribute** to add a key-value pair to the credential's session when it authenticates. Enter a **Custom Attribute Name** and **Attribute Value** for each. Multiple attributes can be added or removed. Optional. |

### Client ID and Secret

Click **Create Credential** to advance to the **Client ID and Secret** tab. The generated **Client ID** and **Client Secret** display here. Copy and store both securely.

> [!WARNING]
> The client secret cannot be retrieved after leaving this tab. If the secret is lost, delete the credential and create a new one. For Creator credentials, click **Revoke** to disable access without removing the credential.

## Credential Actions

Click **Actions** on any row. Available options differ by credential type.

**Express credentials**:

| Action | Description |
| --- | --- |
| ![Eye](https://cdn.us.document360.io/15548f06-2fba-434c-b0c1-5df88317dbd7/Images/Documentation/api_upload_20261013_153207_6fea9100d15c46aebce2deeb16aea64b.svg?sv=2026-02-06&spr=https&st=2026-11-08T03%3A56%3A43Z&se=2026-11-08T04%3A56%3A43Z&sr=c&sp=r&sig=Bx0NeBR4%2BA79BLO8MvxKFWd2nw8WkgGcjyUs1RBfAFE%3D) **View** | Opens a read-only view of the credential's details. |
| ![Pencil](https://cdn.us.document360.io/15548f06-2fba-434c-b0c1-5df88317dbd7/Images/Documentation/api_upload_20261013_153207_3d89e8ebca0c4b9a8b7decfe958fa14a.svg?sv=2026-02-06&spr=https&st=2026-11-08T03%3A56%3A43Z&se=2026-11-08T04%3A56%3A43Z&sr=c&sp=r&sig=Bx0NeBR4%2BA79BLO8MvxKFWd2nw8WkgGcjyUs1RBfAFE%3D) **Edit** | Updates the credential's name, description, roles, groups, or custom attributes. The client secret cannot be changed. |
| ![KeyRound](https://cdn.us.document360.io/15548f06-2fba-434c-b0c1-5df88317dbd7/Images/Documentation/api_upload_20261013_153207_1d3eff6b909243e5bad9c716499933a9.svg?sv=2026-02-06&spr=https&st=2026-11-08T03%3A56%3A43Z&se=2026-11-08T04%3A56%3A43Z&sr=c&sp=r&sig=Bx0NeBR4%2BA79BLO8MvxKFWd2nw8WkgGcjyUs1RBfAFE%3D) **Generate New Secret** | Generates a new client secret and lets Creators set a new expiration period (1 to 730 days). The current secret is immediately invalidated. Not available for revoked credentials. |
| ![Trash2](https://cdn.us.document360.io/15548f06-2fba-434c-b0c1-5df88317dbd7/Images/Documentation/api_upload_20261013_153207_2d6ff6f8805749288a73d49c65e45e85.svg?sv=2026-02-06&spr=https&st=2026-11-08T03%3A56%3A43Z&se=2026-11-08T04%3A56%3A43Z&sr=c&sp=r&sig=Bx0NeBR4%2BA79BLO8MvxKFWd2nw8WkgGcjyUs1RBfAFE%3D) **Delete** | Permanently removes the credential. |

**Creator credentials**:

| Action | Description |
| --- | --- |
| ![Eye](https://cdn.us.document360.io/15548f06-2fba-434c-b0c1-5df88317dbd7/Images/Documentation/api_upload_20261013_153207_6fea9100d15c46aebce2deeb16aea64b.svg?sv=2026-02-06&spr=https&st=2026-11-08T03%3A56%3A43Z&se=2026-11-08T04%3A56%3A43Z&sr=c&sp=r&sig=Bx0NeBR4%2BA79BLO8MvxKFWd2nw8WkgGcjyUs1RBfAFE%3D) **View** | Opens a read-only view of the credential's details. |
| ![Pencil](https://cdn.us.document360.io/15548f06-2fba-434c-b0c1-5df88317dbd7/Images/Documentation/api_upload_20261013_153207_3d89e8ebca0c4b9a8b7decfe958fa14a.svg?sv=2026-02-06&spr=https&st=2026-11-08T03%3A56%3A43Z&se=2026-11-08T04%3A56%3A43Z&sr=c&sp=r&sig=Bx0NeBR4%2BA79BLO8MvxKFWd2nw8WkgGcjyUs1RBfAFE%3D) **Edit** | Updates the credential's name, description, role, or custom attributes. The client secret cannot be changed. |
| ![KeyRound](https://cdn.us.document360.io/15548f06-2fba-434c-b0c1-5df88317dbd7/Images/Documentation/api_upload_20261013_153207_1d3eff6b909243e5bad9c716499933a9.svg?sv=2026-02-06&spr=https&st=2026-11-08T03%3A56%3A43Z&se=2026-11-08T04%3A56%3A43Z&sr=c&sp=r&sig=Bx0NeBR4%2BA79BLO8MvxKFWd2nw8WkgGcjyUs1RBfAFE%3D) **Generate New Secret** | Generates a new client secret and lets Creators set a new expiration period (1 to 730 days). The current secret is immediately invalidated. Not available for revoked credentials. |
| ![ShieldOff](https://cdn.us.document360.io/15548f06-2fba-434c-b0c1-5df88317dbd7/Images/Documentation/api_upload_20261013_153207_a2d9df1108c3489d8554aa7f0a056346.svg?sv=2026-02-06&spr=https&st=2026-11-08T03%3A56%3A43Z&se=2026-11-08T04%3A56%3A43Z&sr=c&sp=r&sig=Bx0NeBR4%2BA79BLO8MvxKFWd2nw8WkgGcjyUs1RBfAFE%3D) **Revoke** | Permanently disables the credential. |
| ![RotateCcw](https://cdn.us.document360.io/15548f06-2fba-434c-b0c1-5df88317dbd7/Images/Documentation/api_upload_20261013_153208_3b812da7d4614907baed385ec8e8ed49.svg?sv=2026-02-06&spr=https&st=2026-11-08T03%3A56%3A43Z&se=2026-11-08T04%3A56%3A43Z&sr=c&sp=r&sig=Bx0NeBR4%2BA79BLO8MvxKFWd2nw8WkgGcjyUs1RBfAFE%3D) **Restore** | Re-enables a revoked credential. Available on revoked Creator credentials only. |
| ![Trash2](https://cdn.us.document360.io/15548f06-2fba-434c-b0c1-5df88317dbd7/Images/Documentation/api_upload_20261013_153207_2d6ff6f8805749288a73d49c65e45e85.svg?sv=2026-02-06&spr=https&st=2026-11-08T03%3A56%3A43Z&se=2026-11-08T04%3A56%3A43Z&sr=c&sp=r&sig=Bx0NeBR4%2BA79BLO8MvxKFWd2nw8WkgGcjyUs1RBfAFE%3D) **Delete** | Permanently removes the credential. |

## Credential Statuses

| Status | Description |
| --- | --- |
| **Active** | The credential is valid and can authenticate. |
| **Expires Soon** | The credential expires in fewer than 21 days. |
| **Expired** | The credential has passed its expiration date and can no longer authenticate. |
| **Locked** | The credential has been locked due to too many failed authentication attempts. Configure lockout thresholds in [Environment Administration](/unqorkai/docs/environment-administration). |
| **Revoked** | The credential has been permanently disabled. |

---

**Changelog**

| Date | Change |
| --- | --- |
| 2026-10-08 | Corrected Credential Actions section: removed Days to Expiration from Edit action; added Generate New Secret action for both Express and Creator credentials. |
| — | Initial publication. |

APIs (application programming interfaces) are a set of protocols and definitions developers use to build and integrate application software. APIs act as the connective tissue between products and services.

OAuth, or Open Authorization, is an authorization protocol that lets users grant third-party access to their information without sharing their passwords. OAuth is an industry standard that's used by many companies, including Google, Amazon, and Microsoft.

Authentication secrets are a value of confidential information. For example, a password, security token, or cryptographic key, that is used to verify a user's identity during the authentication process to grant access to a system or application.

The Unqork front-end application framework that delivers Creator-built applications to end-users. Express is the layer end-users interact with—the published forms, screens, and navigation built in the Module Builder. Express is distinct from Express View, which is a Creator-facing preview tool in the IDE.

Also known as Unqork Users, or Designer Users; is anyone who is inside the Unqork platform.

The client_id is a public identifier for apps

A key-value pair is a fundamental data structure where a unique "key" is associated with a specific "value," used for organizing and retrieving data efficiently, like in dictionaries or databases.

The client secret is a secret known only to the application and the authorization server. The client secret acts as the applications password to the server.

Also known as Unqork Users, or Designer Users; is anyone who is inside the Unqork platform.

## Related

- [Single Sign-On (SSO) Management](/single-sign-on-sso-management.md)
- [Setting Up Okta for SSO in Express (OIDC)](/setting-up-okta-for-sso-in-express-oidc-unqork-platform.md)
- [Setting Up Microsoft Entra ID for SSO in Express (OIDC)](/setting-up-microsoft-entra-id-for-sso-in-express-oidc-unqork-platform.md)