Service user credentials · BreezeAuth Docs

A credential is what a service user uses to prove its identity, the way a person uses a password. Each credential is made of two values:

Value	Example	What it is
Client ID	`5f0c3a8e-2b7d-4e91-9a6c-1d2e3f4a5b6c`	The public identifier of the credential. Not a secret: it can appear in logs and configuration.
Client secret	`kT9wQ2…` (32 characters)	The confidential part, like a password. Whoever has it can act as the service user. Shown only once.

The integration exchanges these two values for a short-lived access token at the /oauth/token endpoint, and then uses the token to call the BreezeAuth API.

A service user can have several credentials, for example one per environment (production, staging) or per deployment. Each credential can be deactivated, can expire and is tracked separately, which also makes rotation possible without downtime.

Create a credential

In the sidebar, select Users, then the Service Users tab, and open the service user.
Select the Credentials tab, then New credential.
Enter a Name that says where the credential will be used, for example “Production” or “CI pipeline”.
Optionally, choose an Expires at date. Leave it empty for No expiration.
Select Create.
The Credential created dialog shows the Client ID and the Client secret. Copy both and store them safely, then confirm with I saved the client secret.

Important: the client secret is shown only once. BreezeAuth stores only a one-way fingerprint (a hash) of it, so nobody, not even BreezeAuth support, can display it again. If it is lost, create a new credential and deactivate the old one.

Store the secret safely

Give it to the integration through a secrets manager or a protected environment variable, never in source code.
Never put it in a web page, a mobile app or anything that runs on users’ devices: anyone could extract it.
Don’t send it by e-mail or chat. If it was exposed, deactivate the credential and create a new one.

Track credential usage

The Credentials tab lists each credential with its Status (Active or Inactive), Last used date, Expires at date and creation date. Last used shows when the credential was last exchanged for an access token, which helps you spot credentials that are no longer used and can be removed.

Select a credential to see its details. Every time a credential is used to obtain an access token, an entry is also recorded in the Audit Logs.

Edit a credential

Open the credential from the service user’s Credentials tab.
Select Edit.
Change its Name, Expires at date or Active option, then select Save.

The client ID and client secret themselves can’t be changed. To replace a secret, rotate the credential.

Deactivate a credential

Deactivate a credential when its secret may have been exposed, when the integration that uses it is retired, or before deleting it.

Open the credential and select Edit.
Clear the Active option and select Save.

Deactivation takes effect immediately:

the credential can no longer be exchanged for access tokens;
every access token already issued with it stops working on its very next API request, even though it has not expired yet. BreezeAuth checks the credential on each request, so there is no window during which a token obtained earlier remains usable.

Other credentials of the same service user keep working. You can reactivate the credential later by selecting Active again.

Expiration

A credential with an Expires at date behaves like a deactivated credential once that moment passes: no new tokens, and tokens issued earlier are refused. To extend it, edit the credential and choose a later date, or clear the date.

Rotate a credential

Rotating means replacing a credential with a new one, for example on a regular schedule or when someone who knew the secret leaves. Because a service user can have several credentials, you can do it without interrupting the integration:

Create a new credential for the same service user.
Configure the integration with the new client ID and client secret, and deploy it.
Check that the new credential’s Last used date updates, and that the old one’s stops changing.
Deactivate the old credential.
Once you are sure nothing depends on it anymore, delete it.

Tip: an Expires at date makes rotation a habit: the credential stops working on a known date, so you can plan the replacement ahead of time.

Delete a credential

A credential must be deactivated before it can be deleted. As long as it is active, the Delete button is disabled with the message “The credential must be disabled first”.

Deactivate the credential.
Open it and select Delete.
In the Delete credential dialog, enter your current password to confirm.

Deleting a credential cannot be undone. Deactivate first, wait to confirm that nothing breaks, then delete.