---
title: 'API Credentials : Generate and Manage Credentials'
deprecated: false
hidden: false
metadata:
  robots: index
---
# Moveworks API Credentials Management

Welcome to the **Credentials** page, where you can manage tokens used to authenticate with Moveworks APIs.

<Callout intent="info">
  **Data Governance**

  This page is only visible to **Super Admins** because it allows the generation of API credentials for analytics data.\
  If you require new credentials or need to edit/remove existing ones, please contact your Super Admin.
</Callout>

## How to navigate to this page.

The credentials page is present under **Moveworks Setup** -> **Tenant settings**.

![](https://files.readme.io/1c1dfaf26014e01232d9efbf97e4678fcc2d7e7604daf071cf1feda87e3b219d-image.png)

<br />

## What are API Credentials?

API credentials are authentication details that enable your organization to access Moveworks APIs.\
Each credential provides access to API products based on the **permissions and scopes** assigned to it.

***

## What Credentials Are Visible to Me?

The **Credentials** tab in Moveworks Setup displays all **Data API credentials**.\
For each credential, you can view the **authentication type** and the **assigned scopes**.

***

## How Do I Create New Credentials?

<Callout intent="info">
  If you participated in the limited preview and already have credentials for the `/v1beta2` version of the Data API, you do not need new credentials.\
  The `/v1beta2` credentials will work seamlessly with the `/v1` version.
</Callout>

You can create new credentials by clicking the **Create** button. During setup, you will be asked to configure the following: (You can only create credentials for Data API through this page)

<Steps>
  <Step title="Enter a Credential Name">
    * Provide a name to identify your credential.
    * Example: `Analytics-DataAPI-Credential`
  </Step>
  <Step title="Select Authentication Type">
    Moveworks supports two authentication methods:
    
    1. **🔑 API Key**
       * Simplest method of authentication.
       * Recommended for **server-to-server integrations** where a static key can be securely stored.
       * After creation, an API key will be provided—store it in a secure secrets manager.
    
    2. **🔒 OAuth 2.0**
       * Secure, token-based authentication.
       * Recommended for scenarios requiring **delegated access** or **token refresh**.
       * After creation, you will receive a **Client ID** and **Client Secret**.
  </Step>
  <Step title="Define Access Scope">
    Scopes determine what data or actions the credential can access. You must select at least one scope.
    
    **Available scopes:**
    
    * **All** → Grants access to all available endpoints.
    * **Conversations** → Access to conversation-level data.
    * **Interactions** → Access to interaction-level data (user messages, AI Assistant responses).
    * **Plugin Calls** → Access to plugin execution data.
    * **Plugin Resources** → Access to plugin resource metadata.
    * **Users** → Access to user details (IDs, emails, attributes).
    
    > **Best practice:** Enable only the scopes required for your use case to follow the **principle of least privilege**.
    
    ![](https://files.readme.io/487d110cee2a2d51d22c106080fda4a55189edf73546bff8df49c0010bb1e001-image.png)
    
    <br />
    
    Once scopes are selected, click **Submit**.\
    A pop-up will display your API Key (for API Key auth) or Client ID & Client Secret (for OAuth 2.0).
    
    ![](https://files.readme.io/9b1b9ff2cf056ec18a265f4e1153a382eeadc73aa031abc204750545b8ab1e75-image.png)
    
    <br />
    
    ⚠️ **Important:** Credentials are shown **only once** in this pop-up.\
    Be sure to store them securely before closing it—after that, they cannot be retrieved.
    
    ***
  </Step>
</Steps>
## Editing Credentials

You can update the following properties of an existing credential:

* Credential name
* Assigned scopes

***

## Deleting Credentials

* Deleted credentials **cannot be restored**.
* If a deleted credential is being used in your data pipelines, those requests will fail with a **`401 Unauthorized`error**.

***

## Credentials Expiry

* **Data API credentials themselves do not expire**. There is no TTL on API Keys or on the OAuth2 Client ID and Client Secret.
* However, the **access token** generated using OAuth2 client credentials **expires after 3600 seconds (1 hour)**.
  * A new token must be generated to continue calling the APIs.

For more details on authentication and authorization, please refer to the [Data API Documentation](https://help.moveworks.com/reference/data-api-overview).