This article walks through registering a new API client. After this you'll have credentials to give the integration plus admin tools to observe and constrain it.
Step-by-Step
- Open Architect Panel → API Clients and click New Client.
- Name and description — be descriptive (“Salesforce Production”, not “sync”).
- Pick auth mode:
- API key for service-to-service.
- OAuth for user-authorised third-party apps.
- Select scopes — list each endpoint family the client may use, and read/write/admin for each.
- Optional restrictions:
- Allowed source IPs / CIDR ranges.
- Rate-limit tier (default, elevated, custom).
- Webhook URL — events fire to this URL when relevant records change.
- Generate credentials. Copy them immediately; the secret is shown once.
Per-Client Configuration Worth Setting
- Idle timeout: Disable client if no calls in 30 days.
- Allowed endpoints: Whitelist beyond scopes — fine-grained access to specific paths only.
- Audit channel: Where the per-client log goes (file, Slack, Splunk).
Worked Examples
- Marketing CRM: Scopes: read+write on Contacts and Email Templates. IP-locked. 5000/min rate. Webhook fires on contact updates so the CRM stays in sync.
- Public OAuth app: Scopes: read on user's own records only. Anyone can authorise; each user controls their own grant.
- Internal tooling: Scopes: admin on everything. IP-locked to office VPN. Rate limit elevated.