Share A Prepared Client With A Team Member

Use a Client Access Grant when an Owner or Admin has prepared a safe Client and an active Team Member should use it without managing API Instances, Policies, Bindings, or upstream credentials.

Web Console

Owner Or Admin: Prepare And Grant

1. Configure the API Instances, mandatory Policies, and Client Bindings.
2. Create separate Clients for different responsibilities, such as Support and Release, instead of giving one broad bundle to every Member.
3. Open the Client detail page, find Member access, select an active Member, and choose Grant access.
4. Confirm that the Member appears with an active Grant.

With the CLI:

apiz client grant add <client-id> --membership <membership-id>
# or exact convenience lookup:
apiz client grant add \
  --client-name "Support agent" \
  --member-email [email protected]

Exact-name/email lookup rejects zero or ambiguous matches; it never fuzzy-runs an access mutation.

Member: Issue Temporary Access

The Member opens My Clients, sees only granted Clients and safe connection help, then creates their own short-lived Temporary Credential. They cannot edit the Client, Binding, Policy, or upstream connection.

apiz client list
apiz client credentials create <client-id> \
  --binding <alias> --ttl 1h --format shell

The server bounds Member expiry and records the issuing User, Membership, Grant, Client, and Credential Group.

CLI And Revocation

Owner/Admin can revoke the Grant in the Client detail page or with:

apiz client grant revoke <client-id> <grant-id>

Revocation immediately invalidates every active credential issued through that Grant. Regranting later does not reactivate old credentials. Access Logs should show the Member-issued requests; Audit Logs should show the safe Grant lifecycle without exposing credential values.

When an already-open Member Console regains focus, it refreshes current Team role and Client access. A revoked Client or Temporary Credential page stops showing the old result as usable and offers Choose an assigned Client. If no Client remains, ask a Team Owner or Admin to restore a Grant, then create a new Temporary Credential; the revoked credential cannot be reused.

Client Access Grants carry no role and do not introduce a new workspace or tenant layer. Team roles remain Owner, Admin, and Member.