# What is the correct method to protect client-facing API?

**URL:** <https://community.auth0.com/t/what-is-the-correct-method-to-protect-client-facing-api/87338>\
**Category:** Get Help\
**Tags:** access-token\
**Created:** [July 21, 2022, 7:57am UTC](https://community.auth0.com/t/what-is-the-correct-method-to-protect-client-facing-api/87338 "2022-07-21T07:57:31Z")\
**Posts on this page:** 1\
**Showing post:** 3

<div class="post-metadata">

**Author:** ![haoran](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/haoran/32/32436_2.png) [@haoran](https://community.auth0.com/u/haoran)\
**Post date:** [July 21, 2022, 11:09pm UTC](https://community.auth0.com/t/what-is-the-correct-method-to-protect-client-facing-api/87338/3 "2022-07-21T23:09:29Z")

</div>

> You probably do not want a situation where multiple customers all share a single client id+secret pair.

100% correct. Each needs their own segregated data, so the API would need to be able to identify each customer, or each company.

(Within our API, if we can identify a customer, we can identify which company(s) they have access to.)

> I think I would assign each customer their own M2M application in Auth0

This seems manageable now where we might have ten clients who want API access. If that number grows to a hundred+ though, that’s unmanageable, unless we build tooling around the management API to automate that whole process.

---

_[View the full topic](https://community.auth0.com/t/what-is-the-correct-method-to-protect-client-facing-api/87338)._