API Credentials
Overview
The API credentials setting allows administrators to create and manage the credentials that external systems use to connect to Leena AI APIs.
Each credential is issued as a self-contained set of keys, restricted to the scopes selected at creation:
- OAuth 2.0 credentials — Client ID and Client secret, used when the integration authenticates with the OAuth 2.0 flow.
- Basic authentication — Username and Password, used when the integration authenticates with HTTP basic auth instead.
Issuing one credential per connecting system means access can be traced to that system and revoked independently, without disturbing other integrations.
How to Access
- Log in to the Leena AI Admin Dashboard.
- Navigate to Settings.
- From the left sidebar, click on API credentials.
- The API credentials page loads with the list of credentials issued for the workspace.
Access: Only dashboard users whose role includes the API credentials permission can view and manage this page. If the menu item is not visible, contact your workspace administrator.
Pre-requisites
- Admin access to the Leena AI dashboard for the workspace you want to issue credentials for.
- Clarity on which Leena AI capability the external system needs to call — this determines the scope you select.
- A secrets manager or equivalent secure store, as credential secrets are displayed only once.
Credentials list
The list shows every credential issued in the workspace, with a count badge against the Credentials heading.
| Column | Description |
|---|---|
| Name | The label given at creation. Used to identify which system the credential belongs to. |
| Client ID | The public identifier for the credential. Safe to share with the integrating team. |
| Allowed scope | The permissions granted to this credential. A single scope is shown as one chip; multiple scopes show as chips with a +N overflow. |
| Status | Active — the credential is usable. Revoked — the credential has been permanently disabled. |
| Created by | Name and email of the dashboard user who created the credential. |
| Actions | Row menu containing Revoke access. Not available on revoked rows. |
Use the Rows per page control (10 / 20 / 50) at the bottom of the table to page through longer lists.
Note: If no credentials have been issued yet, the page shows a No API credentials available empty state with a shortcut to create the first one.
Add credentials
Click Add credentials at the top right of the table to open the Enter Oauth key details dialog.
| Field | Description |
|---|---|
| Auth name | A clear, identifiable name for the credential. This is what appears in the Name column of the list — use the consuming system and environment, for example Workday UAT. Mandatory. |
| Allowed scope | The permissions this credential is granted. Select one or more from the dropdown. Only the selected permissions are honoured; calls to anything outside them are rejected. Mandatory. |
Click Create credentials to generate the credential.
Copying the credentials
On successful creation, the credential detail screen opens with four values across two sections:
| Section | Values | When it is used |
|---|---|---|
| OAuth 2.0 credentials | Client ID, Client secret | When the integration authenticates with the OAuth 2.0 client credentials flow. |
| Basic authentication | Username, Password | When the integration authenticates with HTTP basic auth instead of OAuth. |
The screen also includes a How to use this key section with a ready-to-run command that exchanges these values for an access token. Use the copy icon against each value or against the command block.
Important: Secrets are shown only once. They cannot be retrieved after you leave this page — not by you, and not by Leena AI support. Copy all four values and store them securely before clicking Go back. Leaving the page triggers a Have you saved your credentials? confirmation. If the page is refreshed or opened directly by URL, it shows These credentials can't be shown again — in that case, create a new credential.
For the full token exchange and API usage steps, see API credentials — token generation.
Revoke access
- Open the row menu (⋮) against the credential in the list.
- Click Revoke access.
- Confirm on the Revoke this auth key? dialog by clicking Revoke key.
The credential stops working immediately for any system using it, along with any tokens already issued against it. The row moves to Revoked status and remains in the list as a record; it cannot be reactivated.
Note: Revoking is permanent. To restore access for that system, create a new credential and update the integration with the new values.
Best practices
- One credential per system. Avoid reusing a single credential across integrations — revoking it would break all of them at once.
- Name for the consumer, not the person.
ServiceNow Prodis easier to audit thanTest 1. - Grant the minimum scope. Select only the permissions the integration actually needs.
- Rotate in sequence. Create the replacement credential first, cut the integration over, then revoke the old one.
- Clean up. Revoke credentials for decommissioned integrations and for keys created during testing.
Note: Credentials are scoped to a single workspace. Staging, UAT, and Production each require their own credentials.
Updated 16 minutes ago