Clients & Access Profiles control who can call your APIs and exactly which collections and endpoints they are allowed to reach.
Overview
Every consumer of your APIs — a partner, a mobile app, an internal service — is represented as a client. A client on its own is an identity; the actual credentials and fine-grained permissions live in one or more access profiles beneath it. This separation lets you grant a single client multiple profiles (for example, one for production and one for testing) without duplicating the client identity, and revoke or rotate one profile independently.
API Clients
A client holds a name, description, and logo, and the set of collections it can reach. Two modes:
Scoped client — access is limited to the collections you explicitly list on the client.
Global client — access extends to all collections in the project. Use for internal services you fully trust; prefer scoped clients for partners and external consumers.
You can create multiple clients for the same API — each representing a different consumer (a partner, a mobile app, an internal service). Create one client per consumer so you can grant, monitor, and revoke their access independently without affecting other consumers.
Access Profiles
An access profile bundles two things for a client:
Credentials — the authentication method and the credential the client presents (token, username/password, or JWT).
Scope — which collections the profile may call, and optionally which specific endpoints within those collections.
When a request arrives, its credential resolves to exactly one access profile, and that profile determines what the caller is authorised to do.
Limiting Scope to Collections and Endpoints
An access profile lists the collections it may call — a request to any collection not on the list is refused. For finer control, a profile can also restrict to specific endpoints within an allowed collection; calls to other endpoints in that collection are also refused. Grant the narrowest scope that meets the consumer's needs — it is easier to widen access later than to recover from over-sharing.
Issuing and Rotating Credentials
When you create an access profile you choose an authentication method and generate the initial credential (a token, key, or username/password pair) to share with the consumer. If a credential is compromised or due for rotation, refresh the profile's key to issue a new one and invalidate the old. Because credentials live on the profile rather than the client, rotating one profile does not affect the client's other profiles.
Disabling Access
Each access profile has an Active flag. Turning it off immediately stops requests made with its credentials — callers receive 401 Unauthorized — while preserving the profile's configuration. This is the quick, reversible way to cut off a consumer (a compromised credential, a partner offboarding, maintenance). Re-enable the flag to restore access. Deleting the profile or the client is the permanent option.
Notes
Create one client per external consumer — do not share a client identity between unrelated consumers.
Prefer scoped clients over global clients for partners; reserve global clients for fully trusted internal services.
Use multiple access profiles on a single client for environment separation (production, staging, testing) rather than creating a separate client per environment.
Rotate credentials on a schedule and immediately when a leak is suspected — refreshing a profile key is instant and non-disruptive to other profiles.