> This page is for Data Protection.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.eon.io/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.eon.io/_mcp/server.

# Manage API Credentials

API credentials allow you to work with your Eon account with your own custom code or external apps.
You can limit the permissions with a custom role, allowing you to control the actions your code can perform.

This article explains how to create API credentials and use them to authenticate with the Eon API.

## Create API credentials

To start, in the

API Credentials

page in your global management console, click **Create Credentials**.

#### Before you start

Make sure there's a role that has the exact permissions you want to grant to the credentials.
If there isn't one, you can [create a custom role][manage-custom-roles].

[manage-custom-roles]: /data-protection/account-administration/access-management/roles-and-permissions/manage-custom-roles

#### Name the API credentials

Give a **Credentials name** that describes what you'll use the credentials for.

The name can't be changed after creation.
Make sure the name is clear and descriptive so you'll always be able to easily identify when the credentials are used.

Click **Next** to continue.

#### Choose the role

Select the **Role** you want to grant the set of credentials.
A set of credentials can have one role.

Click **Create Credentials**.
Your credentials are created and the client ID and secret are shown.

#### Copy the client credentials

Copy the **Client ID** and **Client secret**, and store them in a secure place.

Double-check to make sure everything is pasted where it needs to be before continuing.
Don't close the wizard yet.

#### Test the credentials

This step is optional but recommended.
You'll run this from the command line, replacing the `{CLIENT_ID}` and `{CLIENT_SECRET}` placeholders with your actual client ID and secret, respectively:

**`Test the client ID and secret`**

```bash title="Test the client ID and secret"
curl -L 'https://{your_eon_subdomain}/api/v1/token' \
-H 'Content-Type: application/json' \
-H 'Accept: application/json' \
-d '{
  "clientId": "{CLIENT_ID}",
  "clientSecret": "{CLIENT_SECRET}"
}'
```

> **What's that command?**
>
> The preceding curl command is the first API call you make to Eon.
> It sends a request to [Get Access Token][get-token] to generate an access token.
> Access tokens are required for every call you make to the Eon API.
> They're valid for 12 hours, so you'll need to generate a new access token at least twice a day.

[get-token]: /api/api-reference/auth/get-access-token

If you get a 200 response with an access token, your credentials are set up correctly.
If you get an error, double-check the client ID and secret, and try again.

Once you've confirmed your client credentials are correct, you can close the wizard.

You're now ready to use the Eon API.
To get started, review our article on [Authentication][api-authentication], which explains how to use your access token to make API calls.

[api-authentication]: /api/using-the-api/authentication

## Rotate client secret keys

You can rotate a client secret to generate a new secret while keeping the same client ID.
This is useful for periodic security hygiene.

When you rotate a secret:

* The old client secret can no longer be used to make new access tokens.

* Access tokens issued before rotation remain valid until their expiration, up to 12 hours.

* Your client ID stays the same, minimizing the number of items you need to update.

The Eon API provides two methods for rotating secrets:

* **[Rotate Current API Client Secret]**: Allows a client to rotate its own secret.

* **[Rotate API Client Secret]**: Rotates the secret for any set of credentials by specifying the client ID.
  Useful for rotating secrets for multiple API clients at once.

Both endpoints return a response with the client ID and the new client secret.
Make sure to securely store the new secret.
It won't be shown again.

[Rotate Current API Client Secret]: /api/api-reference/auth/rotate-current-api-client-secret

[Rotate API Client Secret]: /api/api-reference/auth/rotate-api-client-secret

## See also

* [About API Credentials](/data-protection/account-administration/access-management/api-credentials/about-api-credentials)
* [Manage Custom Roles](/data-protection/account-administration/access-management/roles-and-permissions/manage-custom-roles)
* Eon API: [Authentication](/api/using-the-api/authentication)
* Eon API: [Rotate API Client Secret](/api/api-reference/auth/rotate-api-client-secret)
* Eon API: [Rotate Current API Client Secret](/api/api-reference/auth/rotate-current-api-client-secret)