> For the complete documentation index, see [llms.txt](https://docs.finqware.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.finqware.com/overview/security-model.md).

# Security model

The Finqware API is protected by a number of keys and tokens.

It is important to follow the best practice around where it's safe to store/use them. You can make an API call from a web application using the `client_id`, but use an `access_token` only from your server-side code. Currently, a generally accepted opinion among security experts is that you cannot safely store secrets in a client application (web or mobile code).

Besides the API keys listed here, the **/v1s** is an extra secured endpoint (recommended for production) that requires message digest & signing - please check the details [here](/dev-guide/signing-api-requests.md).

| Token/key        | Client | Description                                                                  |
| ---------------- | ------ | ---------------------------------------------------------------------------- |
| client\_id       | yes    | An identifier for a tenant app                                               |
| client\_secret   | no     | A secret generated for each tenant app                                       |
| client\_app\_key | yes    | Used to initate a user session                                               |
| temp\_token      | yes    | A temporary token that can be exchanged for an access\_token                 |
| credentials\_id  | no     | A consent record that points to user data (eg: a bank account, an insurance) |
| access\_token    | no     | A permanent token authorizing access to user data                            |