> ## Documentation Index
> Fetch the complete documentation index at: https://developer.secfix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Managing applications

> Create and manage the API applications that hold your credentials and scopes.

API applications are created and managed from the **Developer Console** in the Secfix web app — not
through the API itself. Each application belongs to a workspace, holds a single active token at a
time, and is granted a specific set of [scopes](/scopes).

## Create an application

<Steps>
  <Step title="Open the Developer Console">
    In the Secfix web app, go to the **Developer** page. You need the permission to manage API
    applications in your workspace.
  </Step>

  <Step title="Create the application">
    Give it a **name** and an optional **description**, then choose its access level. Grant the
    minimum the integration needs — for example **Read** for a read-only inventory sync. See
    [Scopes](/scopes).
  </Step>

  <Step title="Copy the client secret">
    On creation you receive a **`client_id`** and a **`client_secret`**. The secret is displayed
    **once** and never shown again — store it in your secrets manager immediately. You can always
    rotate it later.
  </Step>
</Steps>

## Scopes and access levels

The Console offers three access levels, which map to the underlying [scopes](/scopes):

| Access level    | Scope(s) granted         |
| --------------- | ------------------------ |
| **Read**        | `all:read`               |
| **Write**       | `all:write`              |
| **Full access** | `all:read` + `all:write` |

`all:read` grants read access to every resource and `all:write` grants write access to every
resource — see [Scopes](/scopes).

## Rotate the secret

Rotating an application's secret issues a new `client_secret` and **immediately invalidates the
current access token** — the single-active-token rule means the previously issued token starts
returning `401 token_superseded`. After rotating, fetch a fresh token with the new secret. See
[Authentication](/authentication).

## Delete an application

Deleting an application permanently revokes its credentials and any active token. Requests made with
its token afterward fail with `401 unauthorized`.

<Note>
  There is no API to create or manage applications — this is a deliberate security boundary.
  Credential lifecycle lives entirely in the human-operated Developer Console.
</Note>