> ## Documentation Index > Fetch the complete documentation index at: https://help.elationhealth.com/llms.txt > Use this file to discover all available pages before exploring further. # User Accounts Guide - Self-service API credential management > How practice admins generate and manage their own API credentials from Settings in Elation EHR. This feature is currently in **beta** and is available in the **sandbox** environment only. It is not yet available in production, but is a stepping stone toward full self-service credential management in production — we plan to extend this experience to production practices in a future release. ## Overview ### What is self-service API credential management? Elation provides a robust set of APIs that allow third-party applications to integrate with your practice's clinical and administrative data. Previously, obtaining API credentials required contacting Elation Support and waiting for credentials to be issued manually. Self-service API credential management lets Practice Admins generate, manage, and revoke their own API credentials directly from practice settings — giving you immediate control over your integrations without needing to open a support ticket. You can create credentials for either Elation's **Standard API** or the **FHIR API**, and assign [fine-grained scopes](https://help.elationhealth.com/articles/rest/overview/scopes) to control exactly what data each set of credentials can access. ### Who can use it? Self-service API credential management is available to users with the **Practice Admin** role. Only Practice Admins can create, view, modify, or revoke API credentials. For more information about administrative privileges, see [User Accounts Guide - Administrative privileges](/articles/administrative-privileges). ## Workflow Instructions ### Generating API credentials 1. Navigate to **Settings > API Access**. API Access settings page showing the API Keys section with no keys listed and the "+ Create API Key" button in the upper right. 2. Click **+ Create API Key**. In the dialog that appears, enter a **Name** for the key and select the **API type** — either **Elation APIv2** (Elation's proprietary REST API) or **FHIR** (HL7 FHIR R4 API). The API type cannot be changed after creation. Create API Key dialog with Name set to "Test Credentials" and Elation APIv2 selected as the API type; FHIR is the unselected alternative. 3. Click **Create**. You will be shown your **Client ID** and **Client Secret**. Copy these values or click **Download Credentials** to save them to a file. API Key Created dialog with a warning that the Client Secret cannot be shown again, displaying Client ID and Client Secret fields with copy icons, a Download Credentials button, and the "I have saved my credentials securely" checkbox checked. The Client Secret is only shown once. Elation cannot display it again after you close this dialog. Make sure you save it before clicking **Done**. 4. Check the **I have saved my credentials securely** checkbox, then click **Done** to return to the API Access page, or click **Close and Edit Scopes** to configure scopes immediately. ### Managing existing credentials 1. Navigate to **Settings > API Access**. Your existing API keys are listed with their name, API type, Client ID, and creation date. 2. To edit the scopes for a key, click on the 'Scopes' button to open the scope editor. 3. To delete a key, click the trash icon next to the key. ### Selecting scopes When creating or editing API credentials, you will choose which **scopes** to assign. Scopes control what data the credentials are permitted to read or write. For a full explanation of how scopes work and the available scope options, see [Token Scopes](/articles/rest/overview/scopes). In the **Edit Scopes** dialog, scopes are organized by API category (e.g., Billing API, Patient Profile API, Scheduling API). Expand each category to select individual scopes, or use the checkbox next to the category name to select all scopes within it. You can also click **Set All to Read-Only** to quickly restrict the key to read-only access across all categories. Edit Scopes dialog listing 11 API categories (e.g., Orders API: 20/40 selected, Patient Document API: 22/44 selected) with a "Set All to Read-Only" link and unsaved changes warning. Click **Save** when you are done. Scope changes take effect immediately. ### Revoking credentials If you no longer need a set of credentials, or if you believe they may have been compromised, you can revoke them from the API Access page. 1. Navigate to **Settings > API Access**. 2. Click the trash icon next to the key you want to revoke. 3. A confirmation dialog will appear warning that this action cannot be undone. Click **Delete** to permanently revoke the credentials, or **Cancel** to go back. Delete API key confirmation dialog with warning "This action cannot be undone" and Delete and Cancel buttons, overlaying the Test Credentials API key entry. Before revoking credentials, confirm that no active integrations depend on them. Any application using revoked credentials will stop working immediately. ## Important Security Considerations API credentials function like a username and password for your practice's data. Anyone with access to your credentials can read and modify **all of the data in your practice** that the assigned scopes permit. * **Store credentials securely.** Use a secrets manager or encrypted vault. Do not store credentials in plaintext, in email, or in shared documents. * **Do not share credentials** through insecure channels such as email, chat, or sticky notes. * **Revoke credentials immediately** if you suspect they have been compromised. * **Use the narrowest scopes possible** when creating credentials to limit the impact of accidental exposure. ## Frequently Asked Questions ### Do I need to use self-service credentials, or can I still request them from Elation? Self-service credential management is only available in the sandbox environment. If you need production credentials, please continue to contact Elation Support. ### Can I change the scopes on existing credentials? Yes. You can edit the scopes assigned to existing credentials at any time. Changes take effect immediately. ### What happens if I revoke credentials that an integration is using? That integration will immediately lose the ability to authenticate with Elation's API. You will need to generate new credentials and update the integration's configuration before it can reconnect. ### I need to integrate with a specific vendor or lab. Should I use self-service credentials? If you require integration with a named vendor or lab, please contact Elation Support for guidance. Some vendor integrations have specific requirements that may not be covered by self-service credentials. ## Related Articles * [User Accounts Guide - Administrative privileges](/articles/administrative-privileges) * [Getting Started (API)](/articles/rest/overview/getting-started) * [Token Scopes](/articles/rest/overview/scopes)