Skip to main content

API credentials

To embed the widget or call the Wiselook API from your own backend, you need an OAuth2 client. Tenant admins self-serve these from the API credentials page.

Creating a client​

  1. On the API credentials page, create a new client. Give it a name.
  2. Wiselook provisions an OAuth2 client and shows you the client secret once — copy it immediately; it is not retrievable later.
  3. The client is scoped to your tenant. Tokens it mints carry your tenant_id, so the platform always knows which tenant the call is on behalf of.

Scopes​

Customer-issued clients can only be granted public scopes — for example widget_sessions:write (needed to mint visitor sessions for the widget). Internal platform scopes are never available to tenant clients.

Rotating and revoking​

  • Rotate issues a new secret and invalidates the old one. The client id stays the same.
  • Revoke disables the client entirely.

Use rotation on a schedule and revoke immediately if a secret leaks.

See Authentication for how to use the client to mint tokens, and Embed the widget for the full integration.