# Create API credentials

**API Credentials** issues OAuth client-credential pairs for machine-to-machine access —
your own automation reading the audit trail, or exporting policy.

1. **Create credential**, name it for the thing that will use it.
2. Choose **scopes** — read-only ones like `audit:read` where possible.
3. Optionally restrict it to an **IP allowlist** and set an expiry.
4. The **secret is shown exactly once.** Store it in your secret manager before closing
   the dialog.

## Rotating and revoking

- **Reissue secret** generates a new secret; the old one stops working immediately.
- **Revoke** disables the credential for good. It can't be undone — create a new one.

Both actions ask for confirmation, and name the credential in the prompt, because both
break whatever is currently using it.

<!-- shot:api-credentials -->
![API Credentials — create a scoped, expiring credential. The secret is shown exactly once.](https://docs.sentilai.com/uploads/images/gallery/2026-08/oDXapi-credentials.png)
*API Credentials — create a scoped, expiring credential. The secret is shown exactly once.*