> For the complete documentation index, see [llms.txt](https://help.branch.io/llms.txt).

# Credentials (New)

> Manage your Branch account's authentication credentials securely with the Credentials tab. Learn about Branch Key, Secret, and Access Token for safe API integration.

## Overview

The Credentials tab of the Security & Access page is where you manage authentication credentials for your Branch account.

You can access this page by navigating to **Configuration > Security & Access >** [**Credentials**](https://branchdocs.app.link/security-access-credentials) in Branch. To see the **Security & Access** page, you need **View** access to **Sensitive Data**.

> **Attention**
>
> Branch's new experience is rolling out in phases, so your interface may differ. This article covers the Security & Access page in the new experience. To learn more, see [New Branch Overview](https://help.branch.io/account-hub/new-branch-overview.md).

## Credential types

The **Credentials** section displays the authentication credentials needed to access Branch APIs and integrate with external systems. These credentials are essential for programmatic access to your Branch data and for implementing Branch SDKs in your applications.

Branch provides three types of credentials for different use cases. Everyone who can open the tab sees their own Access Token. Only users with **Edit** access to **Sensitive Data** also see the Branch Key and Branch Secret.

### Branch Key

Your Branch Key is a public key used to identify your app. You can think of this as your app's ID card. You'll need it to initialize [Branch SDKs](https://help.branch.io/developer-hub/native-sdks-overview.md) and for basic authentication across [Branch APIs](https://help.branch.io/apidocs/index.md).

Your Branch Key is designed to be used in client-side code and apps.

### Branch Secret

Your Branch Secret is your app's **private** authentication credential. It authenticates your app securely for operations like server-side API calls.

> **Caution**
>
> Your Branch Secret should only be used in secure, server-side environments. Never include your Branch Secret in client-side code, mobile apps, or any publicly accessible locations.

### Access Token

Your Access Token is a unique identifier assigned specifically to you. Each user will have their own Access Token, as long as they have the correct [permissions](https://help.branch.io/account-hub/default-access-levels-users-roles-permissions.md). The Access Token is used to verify your specific permissions within an organization.

It's primarily used for extracting data from certain [APIs](https://help.branch.io/apidocs/index.md) that require additional authentication. If you don't have an Access Token yet, select **Generate token**.

> **Caution**
>
> Your Access Token should only be used in secure, server-side environments. Never include your Access Token in client-side code, mobile apps, or any publicly accessible locations.

## View and copy credentials

Each credential appears in a read-only field. To copy a credential:

1. Navigate to **Configuration > Security & Access >** [**Credentials**](https://branchdocs.app.link/security-access-credentials).
2. Select the **copy icon** next to the credential to copy its value to your clipboard.

## Reset credentials

If you suspect a credential has been compromised or need to rotate credentials for security purposes, you can reset it using the **Reset** button next to it. Resetting works differently for your Branch Key and Branch Secret than for your Access Token.

### Reset your Branch Key or Branch Secret

Resetting your Branch Key or Branch Secret replaces it right away.

> **Caution**
>
> Resetting your Branch Key or Branch Secret will immediately invalidate the old value. Any integrations, applications, or scripts using the old value will stop working until you update them with the new one. Plan your credential rotations carefully to avoid service disruptions.

To reset your Branch Key or Branch Secret:

1. Select the **Reset** button next to the credential you want to reset.
2. Select **Confirm**.
3. Copy the new credential value and update all systems that use it.

### Reset your Access Token

When you reset your Access Token, you choose whether the old token keeps working for 14 days or stops working right away.

To reset your Access Token:

1. Select the **Reset** button next to your Access Token.
2. Select **Keep old access token for 14 days** or **Block old access token immediately**.
3. Select **Confirm**.
4. Copy the new token and update all systems that use it.

If you keep the old token, Branch shows it with its expiration date. You can't reset your Access Token again until the old token expires.

## Best practices

Follow these best practices when working with Branch credentials:

- **Store credentials securely**: Developers should use environment variables or secure credential management systems rather than hardcoding credentials in your codebase.
- **Limit credential access**: Only share credentials with team members who require them for their work.
- **Rotate regularly**: Consider resetting credentials periodically as part of your security hygiene.
- **Monitor usage**: Keep track of where credentials are used so you can update them quickly if needed.
- **Use appropriate credentials**: Always use the Branch Key for client-side implementations and reserve the Branch Secret for server-side operations.