---
title: "Platform Internal Information Point Authentication"
slug: "pip2-authentication"
updated: 2026-08-23T16:09:49Z
published: 2026-08-23T16:09:49Z
canonical: "docs.plainid.io/pip2-authentication"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.plainid.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Platform Internal Information Point Authentication

## Authenticating the Platform Internal Information Point Service

The Platform Internal Information Point Service needs to authenticate before it can retrieve Platform Assets or Agent Identities from the Platform's internal data store. The method depends on where it runs:

- **Cloud PDP** Authentication is preconfigured by PlainID.
- **PAA** uses OAuth. You set this up using a Client Key.

### Obtaining the API Client Credentials for the Platform Internal Information Point Service in the PAA

You can create API Client Credentials at the Environment level, in the Environment Settings screen. When you create an API Client Credential, the Platform automatically assigns it a Client ID and Client Secret.

For more on API Client Credentials and how they work, see [About API Client Credentials](/docs/environment-settings#api-client-credentials).

**To obtain the API Client Credentials:**

1. In **Environment Settings**, click **API Credentials**.
2. Click **Create Client**.
3. In the **Details** panel, enter a **Name** and, optionally, a **Description**.
4. Set the **Token Duration** (in minutes).
5. Under **Permission Type**, select **Admin** or **Viewer**, depending on the access level the Platform Internal Information Point Service needs.
6. Click **Generate Client**. The Platform adds the new API Client Credential to the **List of API Client Credentials** and generates a Client ID and Client Secret for it.
7. To copy the API Client Credentials:
  - Click the credential you created.
  - Copy the **Client ID** using the **Copy** button.
  - Click **Regenerate** next to **Secret** to reveal and copy the Client Secret.
8. Store the Client ID and Secret securely, using an Environment Variable or a Secret Store key in your PAA setup, and reference them in your Platform Internal Information Point Service configuration. The Platform Internal Information Point Service reads these credentials from SM variables at runtime.

> **Note:** To remove an API Client Credential you no longer need, hover over its row in the **List of API Client Credentials** and click the trash icon.

### Network Configuration

If your network restricts outbound traffic, allow the following endpoints so the Platform Internal Information Point Service in your PAA can communicate with your Tenant:

| Endpoint | Purpose |
| --- | --- |
| `POST https://<apiBaseUrl>/api/1.0/api-key/token` | The Platform Internal Information Point Service calls this endpoint to get a token for authentication. It doesn't call this endpoint on every request. |
| `POST https://<apiBaseUrl>/ng-graphql/api/v1/entities/search` | The Platform Internal Information Point Service calls this endpoint with the NG entity query to resolve Platform Assets and Agent Identities. |