---
title: API Security
slug: api-security
docTags: 
createdAt: 2023-03-07T20:38:27.000Z
---

See Also: [Single Sign-On (SSO)](docId:3a_Te7wv_MX9p08OX5HKh)

Other Readings:  [About mTLS ](https://en.wikipedia.org/wiki/Mutual_authentication), [What are RESTful API's](https://aws.amazon.com/what-is/restful-api/), [JSON Web Token (JWT)](https://jwt.io/introduction/)

# API Transport Level Security - mTLS

Mutual TLS, or mTLS for short, is a method for mutual authentication. mTLS ensures that the parties at each end of a network connection are who they claim to be by verifying that they both have the correct private key. The information within their respective TLS certificates provides additional verification.

- mTLS restricts API access to specific PCs/Machines/Devices that have the mTLS certificate installed.
- mTLS will prevent bad actors from accessing your sandbox or production environment or from using your client/secret API keys without permission.
- mTLS provides an extra layer of security to ensure bad actors from remote machines can't access your data. Even if they have access to your API Keys.

# API Access Keys - Client ID and Client Secret

Your account is identified by your Client ID and secured by a Client Secret. These keys authorize you to perform REST API requests. These credentials are required to be sent with each API request.

# Accessing Data via API

You need both the mTLS certificates and API keys to before you can access our APIs.

Read our [Postman Tutorial](docId\:lGTlvIilHGLckN-0QA8mg), [C# Tutorial](docId:3-nZuyHj6LZ8OinqVbEDY), or [Python Tutorial](docId\:zpnZzC23Zo2rjpAmDUWzX) for code examples