Business Applications
Scoped machine credentials for /api Integration access.
Last updated 2026-09-01
What it is
A Business Application is an Integration credential pair for your Business: X-Client-Id and X-Client-Secret. Requests authenticated this way act in the Application’s Business context with only the scopes you grant.
Who can access
Creating, rotating, revoking, and deleting Applications requires an authorized Business session user. Managing Applications themselves is not available via Integration credentials.
How to
Create
- Open Applications in Business settings
- Name the Application, optional description
- Select scopes (resource → create/read/update/delete flags)
- Store the client secret when shown — rotate later if lost
Lifecycle
- Update name, description, or scopes
- Rotate secret if compromised
- Revoke to disable immediately; delete when no longer needed
Scopes
Allowed resources (each with create / read / update / delete):
| Resource |
|---|
| users |
| invitations |
| subscription |
| products |
| services |
| customers |
| clients |
| companies |
| contacts |
| invoices |
| quotes |
| expenses |
Not in Application scopes: roles, Business settings, dashboards, or Applications management.
Constraints
- Secrets are shown at create/rotate time — treat like passwords
- Revoked Applications cannot authenticate
- Least privilege: grant only the resources and actions you need