Creating an API Profile
3 minutes to readAn API profile generates unique credentials for authenticating an external application with the Caspio REST API. Each profile contains a Client ID and Client secret used to obtain an access token, plus settings that control which resources and operations the profile can access.
Create an API profile
- In the left navigation, select Integrations.
- Select the API profiles tab.
- Select Create API profile.
- Enter the following details:
- API profile name — a unique name to identify this profile
- Description — optional notes about the profile’s purpose
- Contact email — the email address associated with this profile
- First name and Last name — the contact person for this profile
- Select Create.
After creation, the profile opens to its detail view with four configuration tabs: General, Credentials, Permissions, and IP Access Control. The Active toggle, available in the upper-right corner on every tab, lets you enable or disable the profile at any time. Disabled profiles cannot be used to authenticate API requests.
General
The General tab stores the profile’s identity and contact information. Select any field to edit it.
- API profile name identifies the profile in the list. Choose a name that clearly reflects the integration or application using the profile.
- Description is optional and can be used to document the profile’s purpose, associated application, or other relevant details.
- Contact email, First name, and Last name identify the person responsible for the profile. These fields are for reference only and do not affect authentication.
Credentials
The Credentials tab provides the information required to connect external applications to the Caspio REST API.
- Documentation URL links to the Swagger documentation for your account’s REST API.
- Token endpoint URL is the OAuth endpoint used to obtain access tokens.
- Integration URL is the base URL for your account’s REST API.
- Client ID is the unique identifier for the API profile.
- Client secret is the confidential key associated with the Client ID. Keep it secure and do not share it publicly.
Select the Copy icon next to any field to copy its value for use in your applications or integrations.
Generate a bearer token
Select Generate bearer token to create a short-lived access token for testing API requests without leaving the Caspio interface.
Regenerate the client secret
Select Regenerate client secret to replace the current one. Applications using the previous secret keep working until their current access token expires, then lose access until you update them with the new secret.
Permissions
Default permissions
Default permissions apply to all resources of the selected type. Use the Default permissions row to enable or disable the available operations, establishing the baseline level of access. Operations may include reading, creating, updating, and deleting both the resource’s structure (design) and its data (records). The available operations vary by resource type.
Custom permissions
Custom permissions override the default for a specific resource. Select Add custom permissions to configure permissions for an individual resource independently of the default. Use this when most resources share the same access level, but certain resources require more restrictive or broader permissions.
IP Access Control
The IP access control tab restricts which IP addresses can use this API profile to make requests.
- Allow all — API requests are accepted from any IP address (default)
- Deny all — all API requests are blocked except for addresses listed in Exceptions
Enter IP addresses or ranges in the Exceptions field. Exceptions support IPv4 addresses and ranges, as well as IPv6 addresses and CIDR ranges. For example:
- IPv4 single address:
203.0.113.1 - IPv4 range:
203.0.113.1-100 - IPv6 single address:
2001:db8::1 - IPv6 range:
2001:db8::/32
Separate multiple entries with commas, spaces, or semicolons, or press Enter after each entry.
