API Clients

Navigate to System > Connections to manage API clients. API clients provide OAuth2-style credentials (Client ID + Client Secret) that external systems use to authenticate with the Koios GraphQL and REST APIs.

If you are integrating from Python, the Python API Client takes these credentials directly and wraps both APIs in typed objects.

Client List

The client table shows all registered API clients with the following columns:

Disabled clients appear at reduced opacity and cannot authenticate until re-enabled.

Bulk Actions

Select multiple clients with checkboxes, then use the Actions menu to enable, disable, or delete them in bulk.

Creating a Client

1. Click Add API Client
2. Enter a Name and optional Description
3. Optionally select one or more Groups to grant the client those roles' permissions. Leave it empty for View Only.
4. Click Create API Client

After creation, a one-time credentials dialog appears showing the Client ID and Client Secret. Copy both values immediately. The secret cannot be retrieved again.

Client Detail Page

Click any client row to view its detail page.

Overview Tab

• Last Activity: when the client last authenticated
• Status: enabled or disabled
• Client Credentials: the Client ID (copyable) and a masked Client Secret. Click the secret field to regenerate it (with confirmation).
• Description: the client's purpose, if set

Roles Tab

Assign roles to the API client to control what it can access. Works the same as user role assignment: tick the roles you want from the checkbox list, then save. A client can hold any number of roles and receives the combined permissions of all of them.

Permissions Tab

Grants permissions directly to the client, on top of anything inherited from its roles. Permissions are grouped by category with a toggle per permission; flip the toggles you want, then click Save Changes. Permissions the client already inherits from a role appear as locked toggles. The layout matches the one used on user detail pages.

Regenerating a Secret

If a client secret is compromised or lost, you can regenerate it from the client's detail page:

1. Click the masked secret field in the Credentials card
2. Confirm the regeneration. This invalidates the current secret immediately
3. Copy the new credentials from the dialog

Any external system using the old secret will stop authenticating until updated with the new one.

Enabling and Disabling

Use the toggle switch in the client detail header or the bulk actions menu on the list page. Disabled clients receive authentication errors on every request. Their credentials remain valid. Re-enabling restores access without regenerating secrets.

What's Next

• Users: manage user accounts
• Roles & Permissions: control what users and clients can access