Manage Credentials
Create and delete OAuth client credentials for a workspace.
Manage Credentials
Credentials are OAuth 2.0 client credentials (client ID and secret) scoped to a single workspace. Your server uses them to authenticate against the context engine API using the client credentials grant.
Requires Admin or Owner role to create or delete credentials. Members can view existing credentials.
Credential access levels
Every credential has an access level that maps to an OAuth scope enforced on the server side.
| Access level | OAuth scope | What it allows |
|---|---|---|
| Read | read | Browse VFS, read content, full-text search, entity resolution, reconciliation, patient list/info |
| Read & Write | write | All of the above, plus ingest (FHIR, CDA, documents), reporting, session management, and patient creation and deletion |
A token with read scope is rejected with HTTP 403 and a WWW-Authenticate: Bearer error="insufficient_scope" header if it calls a write endpoint. The access level is fixed at creation time — delete and recreate a credential to change it.
Guidance: Use Read credentials for AI agents and read-only dashboards. Use Read & Write credentials for server-side ingest workers that push data into the context engine.
See API Overview for the complete endpoint-to-scope mapping.
Create a credential
- Open the workspace in the Console.
- In the OAuth Credentials section, select New credential.
- Enter a descriptive name (e.g.,
production-server,staging-worker). - Choose an Access level: Read or Read & Write.
- Confirm.
A dialog displays the Client ID and Client Secret. Copy both values immediately and store them securely. The secret is shown only once and cannot be retrieved after you close the dialog. If you lose it, delete the credential and create a new one.
Exchange credentials for an access token
Once you have a client ID and secret, use the OAuth 2.0 client credentials grant to obtain a Bearer token:
curl -X POST "https://console.clinia.cloud/api/auth/oauth2/token" \
-H "Content-Type: application/x-www-form-urlencoded" \
-d "grant_type=client_credentials&client_id=<client-id>&client_secret=<client-secret>&resource=https://console.clinia.cloud"{
"access_token": "eyJ...",
"token_type": "Bearer",
"expires_in": 3600
}Pass the access_token value as Authorization: Bearer <access-token> on every API request. Tokens expire after one hour — your application should cache the token and request a new one before it expires.
Delete a credential
Deleting a credential immediately invalidates it. Any application using it will fail to authenticate on the next request. Update your application before deleting.
- Open the workspace and find the credential in the OAuth Credentials table.
- Select Delete and confirm.