Create an application
Personal Data → Actions → Manage API access → Create application
- Give the application a recognizable name and identify its operator.
- Select only the companies the application is authorized to access.
- Select the minimum scopes required for its documented purpose.
- Create the application and copy the generated secret exactly once.
- Test read access before enabling any write or issuance workflow.
Access boundaries
A normal application can access only explicitly granted companies and companies it creates where supported. Platform-wide administration requires separately authorized Eqdeal administration access.
Scopes do not replace company access
The application needs both the required scope and access to the target company. Granting a write scope alone does not authorize every company.
Verify the application before writes
- Authenticate from a server-side environment without exposing the secret.
- List or read only the explicitly granted companies.
- Confirm that an unauthorized company remains unavailable.
- Inspect validation and preview responses before enabling a business-data change.
- Record the application owner and recovery procedure.
Review access over time
Remove companies and scopes that are no longer required, rotate secrets under the credential policy, and disable abandoned applications. An application should have a recognizable operator and documented purpose throughout its life.