---
title: "How do I generate and reveal a client secret?"
slug: "how-do-i-generate-and-reveal-a-client-secret"
tags: ["client id", "client secret", "API access token", "application", "SDK application"]
updated: 2026-04-13T08:45:42Z
published: 2026-04-13T08:45:42Z
canonical: "support.lusid.com/how-do-i-generate-and-reveal-a-client-secret"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.lusid.com/llms.txt
> Use this file to discover all available pages before exploring further.

# How do I generate and reveal a client secret?

To obtain a short-lived OAuth2-compliant API access token you require a *client secret*.

You must create an *application* that pairs a client ID you provide with a client secret and token URL generated by LUSID. You can then use this information in conjunction with the username and password of a valid LUSID user to obtain an API access token and authorise calls to the LUSID API, either [directly](/v1/docs/how-do-i-obtain-and-use-a-short-lived-api-access-token-from-okta) or via the [SDK](/v1/docs/how-do-i-use-an-api-access-token-with-the-lusid-sdk).

## Using the LUSID web app

To create an application and generate a client secret:

1. Sign in to the [LUSID web app](https://www.lusid.com/app) using the credentials of a LUSID administrator.
2. From the left-hand menu, select **Identity and access > Applications**: ![](https://cdn.document360.io/d575ad81-c0ed-4980-bbd1-d59ac5c3de82/Images/Documentation/bd29e5c1-352c-484e-add7-222ce9931fd5.png?sv=2026-02-06&spr=https&st=2026-11-04T02%3A00%3A44Z&se=2026-11-04T03%3A00%3A44Z&sr=c&sp=r&sig=Mw4omuXIfjvoL%2FBXtGNQk72eBZ9%2FHGk7nQyLnnWzkkQ%3D)
3. On the **Applications** dashboard, click the **Create application** button: ![](https://cdn.document360.io/d575ad81-c0ed-4980-bbd1-d59ac5c3de82/Images/Documentation/022521c2-82ef-4869-a0e7-e7d3920df38a.png?sv=2026-02-06&spr=https&st=2026-11-04T02%3A00%3A44Z&se=2026-11-04T03%3A00%3A44Z&sr=c&sp=r&sig=Mw4omuXIfjvoL%2FBXtGNQk72eBZ9%2FHGk7nQyLnnWzkkQ%3D)
4. Specify a **Client Id** (no spaces) and a **Display name**, and click the **Save** button. LUSID automatically generates a client secret.
5. On the **Applications** dashboard, click the ![](https://cdn.document360.io/d575ad81-c0ed-4980-bbd1-d59ac5c3de82/Images/Documentation/01ca8162-b6f3-48f5-be9c-04c4f805ff6b.png?sv=2026-02-06&spr=https&st=2026-11-04T02%3A00%3A44Z&se=2026-11-04T03%3A00%3A44Z&sr=c&sp=r&sig=Mw4omuXIfjvoL%2FBXtGNQk72eBZ9%2FHGk7nQyLnnWzkkQ%3D) **View** icon to reveal the client secret and Okta's dedicated token URL for your LUSID domain: ![](https://cdn.document360.io/d575ad81-c0ed-4980-bbd1-d59ac5c3de82/Images/Documentation/d97aff26-8f82-4764-b43a-36a49abbd20c.png?sv=2026-02-06&spr=https&st=2026-11-04T02%3A00%3A44Z&se=2026-11-04T03%3A00%3A44Z&sr=c&sp=r&sig=Mw4omuXIfjvoL%2FBXtGNQk72eBZ9%2FHGk7nQyLnnWzkkQ%3D)

> [!NOTE]
> **Note:** Exporting credentials is useful when you want to call the LUSID API [using the SDK](/v1/docs/how-do-i-use-an-api-access-token-with-the-lusid-sdk).

## Using the Identity API

You can use the Identity API to create an application and generate a client secret the second and subsequent times you want to do so.

> **Note**: Because you need an API access token to call the Identity API (for which you need a client secret), you'll either need to use the LUSID [web app](/v1/docs/how-do-i-generate-and-reveal-a-client-secret#using-the-lusid-web-app) the first time, or else pass in a [personal access token](/v1/docs/what-is-a-personal-access-token) instead (which doesn't require a client secret).

1. [Obtain an API access token](/v1/docs/how-do-i-obtain-and-use-a-short-lived-api-access-token-from-okta), if possible.
2. Call the [CreateApplication](https://www.lusid.com/docs/api/identity/endpoints/applications/CreateApplication) API, passing in your access token, a client ID and friendly name that are unique within your domain, and a type of `Native`. For example:

```sql
curl -X POST "https://<your-domain>.lusid.com/identity/api/applications"
   -H "Authorization: Bearer <your-access-token>"
   -H "Content-Type: application/json"
   -d "{'clientId':'example-sdk-app','displayName':'Example SDK application','type':'Native'}"
```

The response contains an automatically-generated client `secret`, and an `issuer` that is Okta's dedicated token URL for your LUSID domain:

```json
{
    "id": "0oabw8p5aaGCl5zAA2p8",
    "type": "Native",
    "displayName": "Example SDK application",
    "secret": "k94QiqJMrPOJaoUB0MJecOu0blANeWHX4MdcqdYH",
    "clientId": "example-sdk-app",
    "issuer": "https://lusid-<your-domain>.okta.com/oauth2/aus91lnun55CZDvav6p7"
}
```