How to get your API keys

This section will illustrate how to get your Auth0 FGA API keys to call the API.

Before you start

You must have an Auth0 FGA account. You can sign up for one on the Auth0 FGA dashboard.

Step by Step

When using the Auth0 FGA SDKs or calling the API you will need:

A Store ID
A Client ID (not needed for the Playground environment)
A Client Secret (not needed for the Playground environment)

In order to get your Store ID and your API keys, follow the steps below:

Management Dashboard (Production)
Playground

Management Dashboard

01. Settings page

To obtain your API keys, select “Settings” from the Dashboard’s sidebar menu. Image showing Auth0 FGA settings page

02. Create client and obtain client secret

If you do not have the client secret, you will be presented with the Create Client button. Click this Create Client button.
Enter the client name in the provided text box. This client name will make it easier to identify your clients in the future.
Select the permission set(s) required for this specific client. Click the Create button when done.
A popup window will confirm the client has been successfully created. Make sure to copy the Store ID, Client ID, and Client Secret values. Click Continue once you have saved these values in a secure location.

You will not be able to see the client secret again after this step. It will need to be regenerated if it is ever lost or compromised in any way.

03. Setting relevant environment variables

Env var/Locality	US	Europe	Australia
`FGA_API_URL`	`https://api.us1.fga.dev`	`https://api.eu1.fga.dev`	`https://api.au1.fga.dev`
`FGA_API_AUDIENCE`	`https://api.us1.fga.dev/`	`https://api.eu1.fga.dev/`	`https://api.au1.fga.dev/`
`FGA_API_TOKEN_ISSUER`	`auth.fga.dev`	`auth.fga.dev`	`auth.fga.dev`
`FGA_STORE_ID`	see above	see above	see above
`FGA_CLIENT_ID`	see above	see above	see above
`FGA_CLIENT_SECRET`	see above	see above	see above

04. Obtain bearer token

If the API is to be invoked via the API Docs viewer or directly instead of through SDKs, you will need to obtain access token for use in later steps:

# Requires jq to safely encode credentials as JSON.
curl -sS -X POST 'https://auth.fga.dev/oauth/token' \
  -H 'content-type: application/json' \
  --data "$(jq -n \
    --arg client_id "$FGA_CLIENT_ID" \
    --arg client_secret "$FGA_CLIENT_SECRET" \
    --arg audience "$FGA_API_AUDIENCE" \
    '{client_id: $client_id, client_secret: $client_secret, audience: $audience, grant_type: "client_credentials"}')"
# Use the access_token in the response as FGA_BEARER_TOKEN for direct API calls.

Playground

01. Obtain store ID

The store ID is a unique identifier that uniquely identify the store. To obtain the store ID:

Click on the three dots button on the top-right of the screen
Select Copy Store ID on the top-right of the screen
The store ID is in the clipboard. Store this value in FGA_STORE_ID environment variable.

02. Setting relevant environment variables

Env var/Locality	Playground
`FGA_API_URL`	`https://api.playground.fga.dev`
`FGA_API_AUDIENCE`	N/A
`FGA_API_TOKEN_ISSUER`	N/A
`FGA_STORE_ID`	see above
`FGA_CLIENT_ID`	N/A
`FGA_CLIENT_SECRET`	N/A

Introduction to Auth0 FGA

Permissions Index

FGA Dashboard

Define your authorization model

Write Your Authorization Data

Add Authorization To Your API

Auth0 Relationship Sync

Advanced Modeling

Deprecation Notices & Migrations

Before you start