Create client credentials | Services User Guides

Client credentials let a script, pipeline, or system authenticate to the RAiD API on behalf of your service point, without a person logging in. Unlike an API token, client credentials represent your service point rather than an individual user, and remain active until you rotate or revoke them.

Applicability

This procedure applies to the ARDC RAiD Service User Interface.

Prerequisites

You need to be an authorised Operator or Service Point Admin of the service point you want to create a credential for.

Process

Log in to the RAiD User Interface.
Open the hamburger menu and select Manage service points, then select the service point you administer.
In the left-hand sidebar of the service point page, select Client credentials.
Expand Create client credential, enter a Label to help you recognise this credential later (e.g. rspace-integration), and click Create.
A Credential created panel shows the Client ID and Secret, masked by default — click the eye icon to reveal a value, or the copy icon to copy it. Store the secret securely now; you can view it again later, but only while the credential remains active.
Use the Client ID and Secret to request an access token with the OAuth2 client_credentials grant:
```
curl -X POST "https://iam.prod.raid.org.au/realms/raid/protocol/openid-connect/token" \
  -d "client_id=YOUR_CLIENT_ID" \
  -d "client_secret=YOUR_CLIENT_SECRET" \
  -d "grant_type=client_credentials"
```
This example uses the Production IAM host. Check you're using the right host for your environment (e.g. iam.demo.raid.org.au for Demo) before running these commands.
Use the returned access_token as a bearer token when calling the RAiD API. Unlike an API token, this has no refresh token — request a new one the same way when it expires.

This example uses the Production IAM host. Check you're using the right host for your environment (e.g. iam.demo.raid.org.au for Demo) before running these commands.

A service point may hold at most 10 active client credentials. Revoke one you no longer need to free a slot.

Managing your credentials

The Client credentials table lists every credential for your service point, active and revoked, with its label, creation date, and last-rotated date:

View secret — reveal the credential's current secret again.
Rotate secret — issue a new secret for the same credential. The previous secret stops working immediately.
Revoke — permanently disable the credential. This can't be undone.