Purpose
View and rotate server-side OAuth credentials (Client ID + secret) for OmaxTelecom organization APIs. The Console exposes one credential pair per organization — not a list of multiple API keys.
Console path: API Keys in the main sidebar (top-level item after Support tickets, before the wallet widget).
Prerequisites
- Signed in to the Console
- Organization resolved from your OmaxTelecom ID session (JWT
organizationclaim) - API client provisioned by OmaxTelecom for your organization (otherwise you see Not configured)
How API credentials work
| Concept | Detail |
|---|---|
| Credential type | Keycloak M2M (machine-to-machine) Client ID + client secret |
| Count | One pair per organization, shared across all OmaxTelecom API products |
| Provisioning | Platform staff assign keycloak_m2m_client_id — there is no self-service Create key button |
| Secret visibility | Full secret shown only once immediately after Regenerate secret; otherwise a masked prefix is stored |
| Rotation | Regenerate secret invalidates the old secret instantly in Keycloak |
Page layout
The page uses a single-column layout (max-w-3xl). Browser tab title: API Keys. Breadcrumb: API Keys.
Page header
| Element | Copy |
|---|---|
| Title | API Keys |
| Description | Server-side credentials for OmaxTelecom APIs. Keep your secret private and rotate it if it may have been exposed. |
Card 1 — API access (status)
Summary card at the top of the page.
| Element | Configured | Not configured |
|---|---|---|
| Card title | API access | API access |
| Badge | Configured (primary) | Not configured (secondary) |
| Description | One Client ID and secret pair is shared across all OmaxTelecom API products. | Your organization does not have API credentials yet. Contact support to provision a client. |
Configured summary grid (two columns on desktop):
| Label | Content |
|---|---|
| CLIENT ID | Full Client ID in monospace (truncated if long) |
| SECRET | Status line — see View credentials |
Not configured footer button: Contact [email protected] (mailto:[email protected])
Card 2 — Credentials
Shown only when configured. See View credentials and Rotate secret.
Card 3 — API documentation
Always visible.
| Element | Copy |
|---|---|
| Card title | API documentation |
| Description | Authentication flows, endpoints, and request examples for all OmaxTelecom APIs. |
| Button | View API docs (opens Developer Portal in a new tab) |
Card 4 — Security practices
Muted card at the bottom.
| Element | Copy |
|---|---|
| Title | Security practices |
| Paragraph 1 | Store the secret in a vault or environment variable — not in source control. |
| Paragraph 2 | The same credentials work across Bappy, Whitelabel, and other OmaxTelecom API surfaces. |
| Paragraph 3 | OmaxTelecom may disable keys that are exposed publicly. Rotate immediately if you suspect a leak. |
Steps
-
Open API Keys from the main sidebar.
-
Check the API access badge — Configured or Not configured.
-
If configured, copy your Client ID and review the masked secret status on View credentials.
-
If you need a new secret, follow Rotate secret and update all integrations immediately.
-
Use View API docs for authentication and endpoint reference on the Developer Portal.
Related pages
For authentication flows, endpoints, and request examples, see the OmaxTelecom Developer Portal.
Not available in Console
The API Keys page is not a multi-key manager. These features do not exist in the partner Console:
| Feature | Status |
|---|---|
| Multiple named API keys | No — one Client ID + secret pair per organization |
| Keys list / data table | No |
| Create key form | No — contact [email protected] or platform staff to provision credentials |
| Revoke without rotate | No — only Regenerate secret |
| Scopes / permissions UI | No |
| Expiration dates | No |
| Key naming / labels | No |
| Organization profile section | No — credentials are only on API Keys |
The same credentials authenticate across Bappy, Whitelabel, Telkor, and other OmaxTelecom API surfaces.