Overview

The Credentials tab of the Security & Access page is where you manage authentication credentials for your Branch account.

You can access this page by navigating to Configuration > Security & Access > Credentials in Branch. To see the Security & Access page, you need View access to Sensitive Data.

Attention

Branch's new experience is rolling out in phases, so your interface may differ. This article covers the Security & Access page in the new experience. To learn more, see New Branch Overview.

Credential types

The Credentials section displays the authentication credentials needed to access Branch APIs and integrate with external systems. These credentials are essential for programmatic access to your Branch data and for implementing Branch SDKs in your applications.

Branch provides three types of credentials for different use cases. Everyone who can open the tab sees their own Access Token. Only users with Edit access to Sensitive Data also see the Branch Key and Branch Secret.

Branch Key

Your Branch Key is a public key used to identify your app. You can think of this as your app's ID card. You'll need it to initialize Branch SDKs and for basic authentication across Branch APIs.

Your Branch Key is designed to be used in client-side code and apps.

Branch Secret

Your Branch Secret is your app's private authentication credential. It authenticates your app securely for operations like server-side API calls.

Caution

Your Branch Secret should only be used in secure, server-side environments. Never include your Branch Secret in client-side code, mobile apps, or any publicly accessible locations.

Access Token

Your Access Token is a unique identifier assigned specifically to you. Each user will have their own Access Token, as long as they have the correct permissions. The Access Token is used to verify your specific permissions within an organization.

It's primarily used for extracting data from certain APIs that require additional authentication. If you don't have an Access Token yet, select Generate token.

Caution

Your Access Token should only be used in secure, server-side environments. Never include your Access Token in client-side code, mobile apps, or any publicly accessible locations.

View and copy credentials

Each credential appears in a read-only field. To copy a credential:

1. Navigate to Configuration > Security & Access > Credentials.
2. Select the copy icon next to the credential to copy its value to your clipboard.

Reset credentials

If you suspect a credential has been compromised or need to rotate credentials for security purposes, you can reset it using the Reset button next to it. Resetting works differently for your Branch Key and Branch Secret than for your Access Token.

Reset your Branch Key or Branch Secret

Resetting your Branch Key or Branch Secret replaces it right away.

Caution

Resetting your Branch Key or Branch Secret will immediately invalidate the old value. Any integrations, applications, or scripts using the old value will stop working until you update them with the new one. Plan your credential rotations carefully to avoid service disruptions.

To reset your Branch Key or Branch Secret:

1. Select the Reset button next to the credential you want to reset.
2. Select Confirm.
3. Copy the new credential value and update all systems that use it.

Reset your Access Token

When you reset your Access Token, you choose whether the old token keeps working for 14 days or stops working right away.

To reset your Access Token:

1. Select the Reset button next to your Access Token.
2. Select Keep old access token for 14 days or Block old access token immediately.
3. Select Confirm.
4. Copy the new token and update all systems that use it.

If you keep the old token, Branch shows it with its expiration date. You can't reset your Access Token again until the old token expires.

Best practices

Follow these best practices when working with Branch credentials:

• Store credentials securely: Developers should use environment variables or secure credential management systems rather than hardcoding credentials in your codebase.
• Limit credential access: Only share credentials with team members who require them for their work.
• Rotate regularly: Consider resetting credentials periodically as part of your security hygiene.
• Monitor usage: Keep track of where credentials are used so you can update them quickly if needed.
• Use appropriate credentials: Always use the Branch Key for client-side implementations and reserve the Branch Secret for server-side operations.