---
schema_version: "1"
id: 73f89d0518cf97e056e3531480b435f447df6b89ef2b79da3c156a0f18dc9d66
title: Client Applications, Contracts, and Credentials
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/api-manager/latest/api-contracts-landing-page.md
canonical_url: https://docs.mulesoft.com/api-manager/latest/api-contracts-landing-page
source_site: docs.mulesoft.com
content_type: documentation
content_hash: 80a1fc0621bcf505a9fd3d3039458934fae54d5b0737debb1f38a623fc5f7be1
description: MuleSoft Documentation Site
release: 2.x
latest: true
---
---
product: API Manager
version: 2.x
is-latest-version: true
keywords: contract, register, client, application, secret, credential, instance
---

# Client Applications, Contracts, and Credentials

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

Credentials consist of two keys: the client ID and the client secret. Anypoint API Manager (API
Manager) uses the following types of credentials:

- Client application

- Organization

- Basic Authentication policy

- SOAP proxy

## Client Application Credentials

As the Organization Administrator, after you grant access to applications in Anypoint Exchange
(Exchange), a contract is automatically created between the instance and the application. The
contract gives access to the application based on SLA tiers that you might specify. Only one
contract can exist per instance and application at any time.

As a user, when you request access to an asset from Exchange, your request is automatically approved
if no SLA tiers are defined. If the asset includes an SLA tier, you can either configure your
request so that it is automatically approved despite the SLA tier, or you can request approval
manually.

Client application credentials are generated when you create a new application and request access to
an instance. Requests must include these credentials if the instance is protected by a client ID
enforcement policy. Organization Administrators can configure this enforcement policy to accept
credentials either as headers or as query parameters, although using headers is more secure.

For additional information about client application credentials, see:

- [Request Access to an Instance](https://docs.mulesoft.com/exchange/to-request-access).

- [View Instance Contracts](https://docs.mulesoft.com/api-manager/latest/view-api-contracts).

- [Grant Access to Requests](https://docs.mulesoft.com/api-manager/latest/manage-client-apps-latest-task).

- [Remove Instance Contracts](https://docs.mulesoft.com/api-manager/latest/remove-client-app-latest-task).

- [Obtain the Credentials of a Registered Client Application](https://docs.mulesoft.com/api-manager/latest/access-client-app-id-task).

Default policies that internally enforce client application credentials include:

- [Rate-Limiting SLA](https://docs.mulesoft.com/gateway/latest/policies-included-rate-limiting-sla)

- [Mule OAuth 2.0 Access Token Enforcement](https://docs.mulesoft.com/mule-gateway/policies-included-oauth-access-token-enforcement)
  (Mule v3.8.5 or later)

- [PingFederate OAuth 2.0 Token Enforcement](https://docs.mulesoft.com/mule-gateway/policies-included-pingfederate-oauth-token-enforcement)
  (Mule v3.8.5 or later)

- [OpenID Connect OAuth 2.0 Token Enforcement](https://docs.mulesoft.com/gateway/latest/policies-included-openid-token-enforcement)
  (Mule v3.8.5 or later)

- [JWT Validation](https://docs.mulesoft.com/gateway/latest/policies-included-jwt-validation) (Mule v3.8.5 or later)

For information about how to configure and apply client ID enforcement policies, see
[Client ID Enforcement Policy](https://docs.mulesoft.com/gateway/latest/policies-included-client-id-enforcement).

## Organization Credentials

Organization credentials provide a method to uniquely identify a specific environment, an
organization, or a business group when linking Mule runtime engine (Mule) to an organization using
Anypoint Platform. Mule uses these credentials to connect to and access your organization.

For example, you use environment credentials to connect a local Anypoint Studio (Studio) Mule
deployment to API Manager through Autodiscovery. This connection allows the Studio-deployed
application to be managed by API Manager. See [Review Environment Concepts](https://docs.mulesoft.com/api-manager/latest/environments-concept)
and [Autodiscovery](https://docs.mulesoft.com/mule-gateway/mule-gateway-autodiscovery-overview).

For additional information about configuring and obtaining organization credentials, see
[Configuring Organization Credentials in Mule Runtime 4](https://docs.mulesoft.com/mule-gateway/mule-gateway-org-credentials-mule4).

## Basic Authentication Policy Credentials

The Simple Authentication default policy protects an instance by forcing requests to provide
credentials. These credentials populate a request’s `Authorization` header. For details on building
requests using the Simple Authentication policy, see
[Basic Authentication: Simple Policy](https://docs.mulesoft.com/gateway/latest/policies-included-basic-auth-simple).

The Lightweight Directory Access Protocol (LDAP) Authentication default policy restricts access by
using an LDAP authentication mechanism. LDAP authentication forces requests to provide credentials
in an `Authorization` header and then requests the configured LDAP instance to determine if the
credentials are correct in the provided LDAP context. For details on configuring the LDAP
Authentication policy, see
[Basic Authentication: LDAP Policy](https://docs.mulesoft.com/gateway/latest/policies-included-basic-auth-ldap).

## SOAP Proxy Credentials

You can protect a WSDL that is hosted on a remote location by configuring basic authentication
credentials. For details on building a SOAP proxy, see [Build SOAP Proxies](https://docs.mulesoft.com/api-manager/latest/building-soap-proxy).