API Clients
API Clients enable system-to-system integrations. An external application authenticates with a Client ID and Secret, receives an OAuth 2.0 access token, and can then interact with Vince Platform within the scope of the roles assigned to that client.
Creating an API client
- Go to Administration → Access Management → API-Clients.
- Click + Add API Client.
- Fill in the required fields:
| Field | Description |
|---|---|
| Name | A descriptive name identifying what integration this client is for |
| Role | One or more roles determining what this client can access |
- Click Save.
The platform generates a unique Client ID and Client Secret. Copy the Client Secret immediately — it is not shown again after you leave this screen.
Store the Client Secret securely at the point of creation. If it is lost, you must generate a new one — there is no way to retrieve the original value.
Managing API clients
The API Clients list shows all clients in the tenant. Use the ⋮ menu on each row to Edit the client's name or roles, Regenerate its secret, or Delete the client.
Deleting a client immediately invalidates all tokens issued to it. Any integration using that client will stop working until it is reconfigured with a new client.
Best practices
| Do | Reason |
|---|---|
| Use one client per integration | Isolates access — compromising one client does not affect others |
| Rotate secrets periodically | Limits the exposure window if a secret is leaked |
| Document each client's purpose | Clarifies what each client is for during security audits |
| Test in a non-production environment first | Confirms the integration works before it has access to live data |
Further reading
- Roles — the roles assigned to API clients control their access scope
- Connections — configure the external system connections that API-triggered workflows use