the page is not not public yet
1. Manage Your Client Secrets
You can manage client secrets using the Manage API Credentials page, where you can view, create, and delete client secrets.
1.1 Access to the Manage API Credentials Page
- Visit the Manage API Credentials page https://portal.wmda.info/manage-clients.
- You must login to the portal using MFA (MFA user guide).
- You must have the appropriate user role (
credential manager) assigned by the WMDA team.
Your organisation should designate one or more technical contacts (credential manager) who are responsible for managing client secrets.
Only users with the credential manager role assigned by the WMDA team can access the Manage API Credentials page.
Before contacting WMDA support, confirm internally who is responsible within your team.
If access is required, contact WMDA: support@wmda.info
As credential manager you can use the Manage API Credentials page to:
- View the application registrations and their client ID provided by the WMDA.
- Create new client secrets for these application registrations.
- See expiration date for each client secret.
- Delete client secrets.
1.2 Create a Client Secret
- Visit the Manage API Credentials page https://portal.wmda.info/manage-clients and click on the "Create new secret" button and the pop-up will appear:
2. Provide client secret name and expiration date (1 year maximum) for this secret:
We advise including your name in the "client secret name" field (e.g., "Secret by VM") so the WMDA IT team can contact you if troubleshooting or follow-up is needed.
3. Click on "Create".
4. Copy the client secret that appears:
When you create a new secret, copy and store it securely. After you refresh or return to this page, the full secret will no longer be visible - only the first three characters (hint) will remain. If you don't copy the newly created secret, you lose it, and you'll need to generate a new secret.
Once a new client secret is in use, the old one should be removed to prevent unnecessary expiration reminders and confusion.
1.3 Delete a Client Secret
1. Click on the delete icon next to the secret you would like to delete and confirm your action:
1.4 Expiring Client Secrets
To inform credential managers about secrets that are about to expire, email notifications are sent. See 4. Email Notifications About Expiring Client Secrets below.
Client secret that is about to expire (in less than one month) is marked with an icon next to the expiration date on the Manage API Credentials page:
2. About API Credentials
WMDA IT team creates application registrations for your organisation to facilitate the identification and procurement of stem cell products from around the world. To maintain secure access to these application registrations, the WMDA provides the API Credentials (client ID and client secret) needed to connect to WMDA APIs. Each application registration has a client ID (which is permanent) and requires a client secret to authenticate.
To authenticate with WMDA APIs, a bearer token must be requested from the WMDA. For details on how client ID and client secret are used to retrieve bearer tokens and authenticate future requests to the WMDA API, see API authentication.
Client ID
- Created by the WMDA and shared with your organisation.
- Identifies your application registration connection to the WMDA APIs.
- Permanent - it does not expire and cannot be changed.
Client secret
- A confidential credential linked to a specific client ID.
- Acts like a temporary password for machine-to-machine authentication.
- Required when requesting a bearer token to connect to the WMDA APIs.
- Expires after a set period. A replacement must be created and used.
- Can be managed by your organisation on the Manage API Credentials page.
Client ID stays the same permanently. It does not expire and does not need to be replaced.
Client secret expires after a set period.
When the client secret expires, API connections will stop working until a new secret is created and updated in your systems.
To avoid interruptions, always rotate the secret before it expires. See 4. Email Notifications About Expiring Client Secrets below
3. Application Registration on the Manage API Credentials Page
The Manage API Credentials page lists the application registrations created by the WMDA IT team for your organisation. Each application registration represents access to one or more APIs.
Examples of application registrations you may see on the Manage API Credentials page:
- Partner-NL-OrganisationName-DM
Partner-NL-OrganisationName-SMC
PartnerAlternative-NL-OrganisationName-SMC (sandbox only)
Depending on the API permissions assigned to your application registration, it may have access to the following WMDA resources:
- Search and Match production;
- Search and Match sandbox;
- Match-Connect production;
- Match-Connect sandbox;
- Data Manager production;
- Data Manager sandbox;
PartnerAlternative is a "dummy" application registration for implementers to test their Match-Connect API integration internally. It works only in the Match-Connect sandbox and is provided upon request.
Each application registration has its own client ID and client secret. Visibility depends on your user role and the API permissions assigned to your application registration by the WMDA team.
4. Email Notifications About Expiring Client Secrets
The designated contact(s) (credential manager) for your organisation will automatically receive email notifications from WMDA when a client secret is approaching expiration.
Notifications are sent at the following intervals:
- 6 weeks before client secret expiration.
- 3 weeks before client secret expiration.
- 1 week before client secret expiration - daily reminders until the secret is replaced.
These reminders are sent only to users who have the appropriate user role (credential manager) assigned by the WMDA team.