> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://zuora.ferndocs.com/docs/platform/security-and-identity/oneid-identity-and-access-management/users-in-oneid/api-user-account-management-in-zuora/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://zuora.ferndocs.com/_mcp/server.

# API user account management in Zuora

> This document outlines the management of API user or service accounts in Zuora, detailing their setup, migration to OneID, and authentication methods. It emphasizes API user accounts and OAuth token configurations.

This document outlines the management of API user or service accounts in Zuora, detailing their setup, migration to OneID, and authentication methods. It emphasizes API user accounts and OAuth token configurations.

## API User Account Management

This section details the processes involved in managing API user accounts within Zuora. It includes guidance on creating new API users, generating OAuth client credentials, and resetting passwords for these accounts.

* **Creating new API users in Billing:** After fully transitioning to Zuora OneID, you can still create new API accounts at the local tenant level. The only type of user accounts you can create in Billing will be API user accounts. You can assign only platform roles configured for API users, with API write access enabled and no UI access.
* **Creating new OAuth client credentials:** Generate OAuth tokens for new or existing users under the billing tenant. OAuth tokens are valid indefinitely and can be regenerated as needed without impact.
* **Resetting password for API accounts:** You can reset the password for your API user accounts managed at the local tenant level. The password reset page will allow you to set a new password regularly to meet compliance requirements for your API accounts.

## Important Considerations

* **Access management**: After migration, all configurations for API/service accounts migrated to OneID must be managed exclusively through OneID. For accounts that are not migrated, access can still be managed at the local tenant level.
* **Accidental migration of Basic Auth users**: If these users are mistakenly migrated, credentials will become invalid.
* **OAuth token management**: OAuth tokens can be renewed and managed in Billing without impacting active operations. Always verify the setup to ensure it remains functional.

> This document outlines the management of API user or service accounts in Zuora, detailing their setup, migration to OneID, and authentication methods. It emphasizes API user accounts and OAuth token configurations.

## Docs

- [Create API User Roles in OneID](https://zuora.ferndocs.com/docs/platform/security-and-identity/oneid-identity-and-access-management/users-in-oneid/api-user-account-management-in-zuora/api-user-account-management.md): This task provides a guide to creating API user roles in OneID, focusing on roles with API write access and proper access controls.
- [API User Account Types in Zuora Billing](https://zuora.ferndocs.com/docs/platform/security-and-identity/oneid-identity-and-access-management/users-in-oneid/api-user-account-management-in-zuora/api-user-account-types-in-zuora-billing.md): This document categorizes API user account types in Zuora Billing, detailing their platform permissions and migration compatibility with OneID.