---
title: "What are an API access token and a client secret?"
slug: "what-are-an-api-access-token-and-a-client-secret"
updated: 2025-08-21T11:51:22Z
published: 2025-08-21T11:51:22Z
canonical: "support.lusid.com/what-are-an-api-access-token-and-a-client-secret"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.lusid.com/llms.txt
> Use this file to discover all available pages before exploring further.

# What are an API access token and a client secret?

Every call made to the LUSID API must be authorised by an *API access token*. To obtain an API access token, you require a *client secret*.

Note that a call made:

- Directly to the REST API must supply a pre-generated API access token as a Bearer token in the Authorization HTTP header. [See how to do this](/v1/docs/how-do-i-obtain-and-use-a-short-lived-api-access-token-from-okta).
- Indirectly using the LUSID SDK must provide credentials in a secrets file or as environment variables to helper classes that automate the process of obtaining an API access token and refreshing it upon expiry. [Find out more about this](/v1/docs/how-do-i-use-an-api-access-token-with-the-lusid-sdk).

An API access token encapsulates the [roles](/v1/docs/what-is-a-role) assigned to the calling [user](/v1/docs/what-are-a-personal-user-and-a-service-user), and so determines the permissions granted to that user to perform operations within LUSID.

There are two types of API access token:

- The recommended and most secure option is to [obtain a short-lived OAuth2.0-compliant token](/v1/docs/how-do-i-obtain-and-use-a-short-lived-api-access-token-from-okta) on demand from LUSID’s identity provider, Okta, or by [configuring LUSID to use your own identity provider](/v1/docs/how-do-i-configure-lusid-to-use-a-different-api-access-token-issuer). To do this, you require the username and password of a valid LUSID account, and also a [client ID and client secret](/v1/docs/how-do-i-generate-and-reveal-a-client-secret) unique to your application so that Okta only grants tokens to authorised requestors.
- There may be circumstances in which it is not possible to use a short-lived OAuth2.0-compliant API access token. You can create and use a long-lived [personal access token](/v1/docs/what-is-a-personal-access-token) instead, though note this is less secure.