> ## Documentation Index
> Fetch the complete documentation index at: https://docs.knoxcall.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Managing Client Permissions

> Control client access to routes, manage API keys, and monitor client activity. Intermediate guide.

# Managing Client Permissions

Control which routes clients can access and manage API keys securely.

## Route Permissions

### Restrict Client to Specific Routes

**Why?** Give partner integrations access only to what they need.

**How:**

1. Edit client
2. Under **Allowed Routes**, select specific routes
3. Save

Now this client can only access those routes. Requests to other routes will be denied.

### Route-Level Restrictions

You can also restrict from the route side:

1. Edit a route
2. Under **Allowed Clients**, select specific clients
3. Save

Only those clients can access this route.

**Best practice:** Use client-level restrictions for third parties, route-level for sensitive endpoints.

## API Key Management

### Viewing Keys

Only the first 12 characters (`key_prefix`) are stored and shown in the UI:

```text theme={"dark"}
tk_a1b2c3d4_abc1... → tk_a1b2c3d4_a (shown)
```

This prevents accidentally exposing keys.

### Rotating Keys

**When to rotate:**

* Every 90 days (scheduled maintenance)
* Suspected compromise
* Employee offboarding
* App decommission

**How to rotate:**

1. Open client details
2. Click **Rotate Key**
3. Copy new key
4. Update applications
5. Old key stops working immediately

**Pro tip:** Generate new key first, update apps, then revoke old key.

### Revoking Access

**Temporary disable:**

1. Open client
2. Click **Disable**
3. Re-enable later if needed

**Permanent removal:**

1. Click **Delete Client**
2. Confirm
3. Key is revoked immediately

## Rate Limiting Per Client

Apply limits per client:

1. Edit route
2. Enable **Rate Limiting**
3. Configure per-client limits:
   * **Requests:** 1000
   * **Window:** 60 seconds
   * **Burst:** 1200

Prevents abuse and ensures fair usage.

## IP Allowlisting

Restrict client to specific IPs:

1. Edit client
2. Add **Allowed IPs**:
   ```text theme={"dark"}
   192.168.1.1
   10.0.0.0/8
   ```
3. Save

Only requests from those IPs will be accepted.

## Monitoring Client Activity

Track client behavior:

1. Go to **Analytics**
2. Filter by client
3. Monitor:
   * Request volume
   * Error rates
   * Response times
   * Geographic distribution

### Set Up Alerts

Get notified of issues:

* Error rate > 10% for this client
* Unusual request volume
* Requests from unexpected locations

## Client Organization

### Naming Convention

Use clear, consistent names:

```text theme={"dark"}
[env]-[app]-[version]
```

Examples:

* `prod-mobile-ios-v2`
* `staging-web-app`
* `partner-acme-integration`

### Use Descriptions

Document important details:

* Purpose of this client
* Owner/team
* Created date
* Next rotation date

## Troubleshooting

**"Invalid API Key"**

* Key was rotated or revoked
* Check last 8 characters match
* Verify client is enabled

**"Access Denied"**

* Client lacks permission for this route
* Check client's allowed routes
* Check route's allowed clients

**High Error Rate**

* Review client's error logs
* Check if backend is having issues
* Consider disabling if abusive

## Next Steps

* Set up environments for per-env API keys
* Learn about secrets for backend credentials
* Configure monitoring and alerts

***

<CardGroup cols={2}>
  <Card title="📊 Statistics" icon="chart-line">
    * **Views**: 1
    * **Helpful**: 0 👍
    * **Level**: intermediate
  </Card>

  <Card title="🏷️ Tags" icon="tags">
    `clients`, `permissions`, `security`, `api-keys`
  </Card>
</CardGroup>