API Clients and Credentials

An API client represents one machine-to-machine integration.

Each API client has a clientId and clientSecret. Use these credentials to call Create Access Token, then use the returned Bearer token to call REST APIs.

Client Fields

Field	Description
Client name	Human-readable name used in the developer console
clientId	Client identifier used to obtain access tokens
clientSecret	Secret value used to request access tokens
Scopes	Permissions granted to this API client
Status	Whether the API client is active or disabled

Credential Rules

• clientSecret is shown only when it is created or rotated
• After leaving the creation or rotation page, clientSecret is not shown again in plain text
• Store clientSecret only in server-side secret storage
• Do not store clientSecret in browser code, mobile apps, public repositories, or screenshots
• Use one API client per integration or environment when possible
• Disable unused API clients

Token Usage

API clients do not call device APIs directly with clientSecret.

They first exchange credentials for an access token:

POST /wlte/v1/auth/token

Then they call REST APIs with:

Authorization: Bearer {accessToken}

Rotation Guidance

Credential rotation should be planned so that service downtime is avoided.

Recommended process:

1. Create or rotate to a new clientSecret.
2. Deploy the new secret to your server-side integration.
3. Verify token creation and one read-only API call.
4. Stop using the old secret.
5. Disable or revoke the old secret if the console supports it.

If a credential may have been exposed, disable it immediately and create a new one.