API clients
API client self-service is in Beta. Strise enables it per team — contact tech@strise.ai to get started.
Teams can create, rotate and revoke their own credentials for the Strise Connect API directly in Settings, without waiting for Strise to issue them. A credential is an OAuth client: a client ID and a client secret that your integration exchanges for a short-lived access token.
A client created here acts on behalf of the team it was created in, and only that team. It inherits nothing from the personal access of the person who created it.
Where to find it
Settings → Developer → API Keys. The tab appears once Strise has enabled self-service for your team, and only for users who hold the View API clients permission. Creating, rotating and revoking additionally require Create API clients. Among the built-in roles, Team Admin holds both; Analyst, Manager and Auditor hold neither, because credentials are team configuration rather than casework. See Members for how roles are assigned.
Creating a client
Create OAuth client opens a dialog with two fields:
| Field | What it controls |
|---|---|
| Name | How the client is labelled in the list and in the activity log. Required, at most 100 characters. Pick something that names the integration, e.g. a system name. |
| Access token lifetime | How long each access token stays valid: 1 hour (default), 8 hours or 24 hours. Shorter is safer; the client can request a new token at any time. |
On save, the client ID and the client secret are shown once. Copy the secret into your secret store before closing the dialog. Strise stores only a hash of it and cannot show it again — if it is lost, rotate the secret to get a new one.
Using the credentials
Your integration exchanges the client ID and secret for a bearer token with the
clientAccessTokenGenerate mutation on the Connect API, then sends that token in the
Authorization header of every request:
mutation ClientAccessTokenGenerate {
clientAccessTokenGenerate(clientId: "YOUR_CLIENT_ID", clientSecret: "YOUR_CLIENT_SECRET") {
expires
token
}
}{
"Authorization": "Bearer <token>"
}The token is valid for the lifetime you chose when creating the client. Request a new one when it expires — there is no limit on how often a client may do so. The full authentication walkthrough, including the schema explorer, is in the Connect API reference.
The client list
| Column | Contents |
|---|---|
| Name | The display name given at creation. |
| Client ID | The public identifier. Click it to copy. |
| Token lifetime | The access-token lifetime configured for the client. |
| Created | When the client was created. The list sorts newest first by default. |
| Last used | When the client last requested a token, or Never. Updated at most once every five minutes, so a busy client shows a time up to five minutes old. |
| Status | Active or Revoked. An active client that was recently rotated also shows Previous secret active until the old secret stops working. |
Hide revoked is on by default; untick it to see every client the team has ever created.
Rotating a secret
Rotate secret issues a new secret for an existing client. The client ID does not change, so nothing in your integration needs to be re-registered — only the secret is swapped.
The dialog asks how long the current secret should keep working:
| Option | When to use it |
|---|---|
| Immediately | The secret has leaked. The old secret stops working the moment you confirm. |
| 1 hour, 8 hours, 24 hours | Routine hygiene rotation. Gives you time to deploy the new secret before the old one stops working. 24 hours is the default and the longest window offered. |
The new secret is shown once, exactly as at creation. A client keeps at most one previous secret: rotating again while a window is still open retires that earlier secret at once, whatever window it was given.
Rotation does not invalidate access tokens that have already been issued. They keep working until they expire, which is at most the client's token lifetime.
Revoking a client
Revoke permanently stops a client from requesting new access tokens. Tokens it already holds keep working until they expire — so after revoking, the client's API access ends within its configured token lifetime, at most 24 hours. A revoked client stays in the list for reference but cannot be reactivated; create a new client instead.
Credential limit
A team may hold at most 5 active credentials. The counter next to the list shows how many are in use. At the limit, Create OAuth client is disabled until you revoke a client you no longer use. Revoked clients do not count towards the limit.
Clients shared with another team
Some clients provisioned by Strise before self-service serve more than one team. For those, Rotate secret and Revoke are disabled, because either action would break the other team's integration. Contact tech@strise.ai to change such a client.
Audit trail
Creating a client, rotating its secret and revoking it are each recorded in the team's Activity Log, with who did it, the client's name and when. Together with the Last used column, this lets you answer "who created this credential, and is it still in use?" without involving Strise.
When self-service is switched off
Self-service gates only the creation of new clients. If Strise switches it off for your team, the clients you already have keep working, and you can still list, rotate and revoke them. To cut off a team's API access, revoke its clients.
Related
- Strise Connect API — what the API offers and where the reference lives.
- Webhooks — push notifications from Strise to your systems.
- Members — assigning the roles that carry the API client permissions.
Last updated on