Secure Access Credentials

Last updated
Save as PDF

You can use Secure Access Credentials to authenticate Workflows requests to Secure Access. Each credential stores an API Key ID and API Key Secret.

The scopes assigned when you create the key determine which atomics and API endpoints it can access. A key's name or type alone does not determine its permissions.

Prerequisites

In Secure Access, go to Admin > API Keys and create the API key required by your workflows. Select the necessary scopes, choose an expiration date, and save the API Key ID and API Key Secret.

Copy the API Key Secret when the key is created. You cannot retrieve it later.

Choose the Correct Credentials

Use separate credentials for operational workflows and API-key administration:

For normal workflow operations, create an operational API key with only the required policies, deployments, reports, or other resource scopes.
For workflows that call /admin/v2/apiKeys, create a separate Key Admin API key with only the required admin.apikeys:* scopes.
Save each key as a separate Secure Access Credentials account key and select the credential appropriate for the workflow.

Minimum Scopes for Included Atomics

Select the atomic workflows you plan to use, then grant the corresponding minimum scopes. Read-only workflows need the listed :read scope. Workflows that create, update, or delete resources need the corresponding write or operation-specific scope.

Atomic family	Minimum scopes
API Keys	admin.apikeys:read for the included Get API Keys atomic.
Private Resources	policies.privateresources:read for read operations and policies.privateresources:write for create, update, and delete operations.
Private Resource Groups	policies.privateresourcegroups:read for read operations and policies.privateresourcegroups:write for create, update, and delete operations.
Connector Groups and Connectors	deployments.resourceconnectors:read for read operations and deployments.resourceconnectors:write for create, update, and delete operations.
Network Tunnel Groups	deployments.networktunnelgroups:read for read operations and deployments.networktunnelgroups:write for create, update, and delete operations.
Network Tunnel Regions	deployments.regions:read.
Network Devices	deployments.networkdevices:read for read operations and deployments.networkdevices:write for create, update, and delete operations.

These are the minimum scopes for the included atomics. If you use Generic Secure Access API Request to call another endpoint, add the scopes required by that endpoint.

Successful authentication confirms that the API Key ID and API Key Secret can obtain an access token. A request can still return 403 Forbidden when the key lacks the scope required by the selected endpoint or the organization lacks the necessary entitlement.

For the current scope-to-endpoint mapping, see Secure Access OAuth 2.0 Scopes and the Secure Access Key Admin API overview.

Adding Secure Access Credentials

Complete the following steps to create a new Secure Access account key:

In Workflows, go to Automation > Account Keys.
Select New Account Key.
Select Secure Access Credentials.
Enter a unique display name and a brief description that identifies the key's intended use.
Enter the following values from Secure Access:
- API Key ID: The identifier created for the API key.
- API Key Secret: The secret created with that API Key ID.
Select Save.

Credential Fields

Field	Required	Secret	Description
API Key ID	Yes	No	Identifier generated for the Secure Access API key.
API Key Secret	Yes	Yes	Secret generated with the API Key ID. Store it when the key is created because it cannot be retrieved later.