If a developer, IT contact, or integration partner needs to connect an outside tool to your BrightMove account (a reporting dashboard, a custom automation, a partner integration) they'll ask you for something called an OAuth Client. This article walks you through creating one, handing it off safely, and managing it afterward. No technical background required.
What is an OAuth Client, and do I need one?
An OAuth Client is a pair of credentials (a Client ID and a Client Secret) that lets an outside application securely connect to your BrightMove data through our API, without needing your personal login or password.
You'll need one whenever:
A developer or vendor is building or maintaining an integration with your BrightMove account
Your IT team is connecting BrightMove to another system (a BI tool, a data warehouse, an internal dashboard)
Someone asks you for "API credentials" or "an OAuth client" for BrightMove
You do not need to understand how the credentials work under the hood. Once you generate them, your developer or IT contact takes it from there. If they need the technical setup details, point them to our Developer Documentation. This article only covers the BrightMove side: creating and managing the credentials themselves.
Two ways to create a client
BrightMove supports two ways to set one up, depending on who the integration should run as:
Where | Settings → API Key | Settings → OAuth Clients |
Who can do it | Any user, for themselves | Users with the "Manage OAuth Clients" permission (typically company/HR admins) |
Use when | You personally are setting up an integration | You're setting one up on behalf of a colleague, or centrally managing integrations for your company |
Most recruiters and hiring managers will only ever need the first option. HR admins managing integrations for the wider team will use the second.
Option 1: Create a client for your own account
Go to Settings.
Click the API Key tile.
Scroll down to the OAuth Clients section.
Click Create OAuth Client.
Give it a Name (something that identifies what it's for, e.g. "Acme Reporting Dashboard") and, optionally, a Description.
Click Save.
You'll immediately see a Client ID and Client Secret.
Copy both of these now. The Client Secret is shown exactly once. If you navigate away without copying it, you cannot retrieve it again, and you'll need to rotate the secret (see below) to get a new one.
Option 2: Create a client on behalf of another user (admins)
This requires the Manage OAuth Clients permission. If you don't see this option, ask your BrightMove administrator to grant it, or to create the client for you.
Go to Settings.
Click the OAuth Clients tile.
Click Add OAuth Client.
Choose the User this client should act as. The integration will have the same access and permissions as that user.
Give it a Name and, optionally, a Description.
Click Save.
Just like the self-service flow, the Client Secret is shown once; copy it immediately.
The OAuth Clients page also shows every client already created for your company, including who owns each one, so you have one place to review what integrations exist.
Handing credentials off to a developer or vendor
Once you have a Client ID and Client Secret:
Share them with your developer/vendor through a secure channel (a password manager, an encrypted note, etc.). Never over plain email, chat, or a shared document.
Send them to our Developer Documentation for the technical integration steps (how to exchange these credentials for access and call the API). That's written for developers, not for BrightMove admins; you don't need to read it yourself unless you want to.
Treat the Client Secret like a password. Anyone who has it can access BrightMove data as that client, so only share it with people who genuinely need it, and never post it anywhere public (a support ticket, a GitHub repo, a shared spreadsheet).
Managing an existing client
From either the API Key page (your own clients) or the OAuth Clients page (admins, all clients), each client in the list has two actions:
Rotate Secret: generates a brand-new Client Secret for that same Client ID, invalidating the old secret. Use this if a secret may have been exposed, or as routine security hygiene. Note: rotating doesn't immediately cut off access already granted. Any access token issued with the old secret keeps working until it naturally expires (by default, within an hour), so plan a rotation with your developer if the integration must not have any downtime.
Revoke: permanently disables the client. Use this when an integration is being retired, a vendor relationship ends, or an employee who owned a client leaves the company. A revoked client cannot be un-revoked; a new one would need to be created.
Quick recap
Setting one up for yourself: Settings → API Key → Create OAuth Client
Setting one up for someone else: Settings → OAuth Clients → Add OAuth Client (requires the Manage OAuth Clients permission)
Copy the Client Secret immediately. It's shown only once.
Rotate if a secret is compromised; Revoke when an integration or its owner is gone
Send developers to docs.brightmove.com for the technical setup