Home > Multi-tenant administration > OAuth client tiers
OAuth client tiers
Last updated: 2026-11-03Cadence: Monthly (audit) and Yearly (secret rotation)
Subscription model: Tenant-level OAuth: all subscriptions. Region-level OAuth: multi-tenant subscriptions only. Organization-level OAuth: organization with multiple subscriptions.
Roles: Tenant Admin (TA), Service Account Owner (SAO)
Last verified: 2026-05
| Initial | Recurring | |
|---|---|---|
| Estimated time | 2 hr | 30 min monthly / 1 hr yearly |
Benefits:
- Avoids orphaned bot users with TenantAdmin-equivalent privileges after OAuth client deletion
- Forces secret rotation on a documented cadence
- Maintains the principle of using the narrowest tier that fits each workflow
Goal
Qlik Cloud offers three OAuth2 client tiers; choose the narrowest tier that fits the workflow. Note that region-level OAuth clients are only available to subscriptions entitled to more than one tenant—single-tenant subscriptions can't create them. Note also that the first time any M2M OAuth client (tenant-, region-, or organization-level) requests a token, a non-interactive bot user is automatically created with TenantAdmin-equivalent privileges on each affected tenant; treat each bot user as a privileged identity in your audit trail.
| Tier | Where created | Scope | Typical use |
|---|---|---|---|
| Tenant-level | OAuth settings in the tenant admin console | One tenant only; supports all client types. First M2M token request creates a bot user with TenantAdmin-equivalent privileges on that tenant | Per-tenant integrations, embedded analytics, qlik-cli |
| Region-level | My Qlik (SAO only) | All tenants in one region of the subscription; M2M only, fixed scopes (admin_classic, tenants:create, tenants:deactivate, tenants:reactivate). Requires a multi-tenant entitlement |
Cross-tenant Platform Operations within a region; required for Create Tenant |
| Organization-level | My Qlik (SAO only) | All tenants across all subscriptions and regions in the organization. Intended for M2M / programmatic cross-tenant access (Qlik's organization-OAuth help page describes only programmatic use cases). | Cross-subscription Organization REST APIs; large-scale OEM operations |
Tasks
| Task | TA | AA | DA | AuA | SAO |
|---|---|---|---|---|---|
| Inventory every region-level and organization-level OAuth client and the bot user it creates per tenant | ✓ | ✓ | |||
| Rotate region-level / organization-level client secrets on a documented schedule (no longer than your secret-rotation policy allows) | ✓ | ✓ | |||
| When a region-level OAuth client is deleted in My Qlik, also remove the orphaned bot user account from each tenant where it ran | ✓ | ✓ | |||
| Treat tenant-, region-, and organization-level secrets like passwords—never check them into source control | ✓ | ✓ |
Automation helpers
- Alert API key owners about API key expiration within X days—Surfaces approaching-expiry keys alongside the documented OAuth secret-rotation cadence.
References
- OAuth Overview (qlik.dev)
- Create a region level M2M OAuth2 client (qlik.dev)
- Managing OAuth clients in My Qlik (Qlik Help)
- Creating and managing OAuth clients (Qlik Help)
- Organization APIs for cross-tenant access (qlik.dev)
Tags: #monthly #yearly #multi_tenant #oauth #m2m #secrets