# Client Credentials and API Contracts

*MuleSoft Platform Architect Study Guide · Governing web APIs on Anypoint Platform · Last updated November 13, 2026 · https://www.certifyforce.com/study-guide/mulesoft-platform-architect/governing-web-apis-on-anypoint-platform/client-credentials-and-api-contracts*

Send application credentials according to the selected enforcement policy while separating user authentication, runtime identity and instance-specific contracts.

- Certification: Salesforce MuleSoft Platform Architect
- Exam section: Governing web APIs on Anypoint Platform
- Study guide: https://www.certifyforce.com/study-guide/mulesoft-platform-architect

**Official exam objective:**

> Describe in what circumstances and how to pass client ID and secret to a web API.

## What the exam expects

- Determine when an API request must carry client application credentials.
- Keep user authentication, application identity and runtime credentials distinct.
- Match credential placement to the applied policy's extraction configuration.
- Reuse an application identity across instance-specific access contracts appropriately.

A **client ID** identifies a registered consumer application; its **client secret** is the associated application credential; an **API contract** grants access to a particular instance; a **credentials origin** tells the policy where to extract values; **LDAP Basic authentication** validates a directory user's credentials ([Contracts and credentials](https://docs.mulesoft.com/api-manager/latest/api-contracts-landing-page), [Client enforcement](https://docs.mulesoft.com/mule-gateway/policies-included-client-id-enforcement), [LDAP policy](https://docs.mulesoft.com/mule-gateway/policies-included-basic-auth-ldap)).

## Key facts

| Fact | Detail | Source |
| --- | --- | --- |
| Credential subject | Application credentials identify the consuming client application. | [Contracts and credentials](https://docs.mulesoft.com/api-manager/latest/api-contracts-landing-page) |
| Access requirement | Client enforcement requires an approved application contract. | [Client enforcement](https://docs.mulesoft.com/mule-gateway/policies-included-client-id-enforcement) |
| Configured location | Basic origin or custom expressions determine request extraction. | [Client enforcement](https://docs.mulesoft.com/mule-gateway/policies-included-client-id-enforcement) |
| Separate identities | LDAP can read user Basic credentials while client enforcement reads separate app headers. | [LDAP policy](https://docs.mulesoft.com/mule-gateway/policies-included-basic-auth-ldap), [Client enforcement](https://docs.mulesoft.com/mule-gateway/policies-included-client-id-enforcement) |
| Optional secret | A blank custom secret expression makes that policy input optional. | [Client enforcement](https://docs.mulesoft.com/mule-gateway/policies-included-client-id-enforcement) |
| Reused application | Same-provider access to another instance needs a separate approved contract, not new app credentials. | [Requesting access](https://docs.mulesoft.com/exchange/to-request-access) |
| Runtime credentials | Platform/environment credentials link runtime to platform, rather than identifying an API consumer. | [Contracts and credentials](https://docs.mulesoft.com/api-manager/latest/api-contracts-landing-page) |
| Contract cardinality | One contract per instance and application at a time. | [Contracts and credentials](https://docs.mulesoft.com/api-manager/latest/api-contracts-landing-page) |

## Check yourself

- When auditing a previously configured LDAP User Password, can the stored value be viewed or retrieved?
- When entering the LDAP Server URL, which network detail must be included?
- When invalid credentials reach Client ID Enforcement in Custom mode, which WWW-Authenticate value identifies that mode?

## Sources

- [Client ID Enforcement Policy](https://docs.mulesoft.com/mule-gateway/policies-included-client-id-enforcement)
- [Basic Authentication: LDAP Policy](https://docs.mulesoft.com/mule-gateway/policies-included-basic-auth-ldap)
- [Requesting Access](https://docs.mulesoft.com/exchange/to-request-access)
- [Client Applications, Contracts, and Credentials](https://docs.mulesoft.com/api-manager/latest/api-contracts-landing-page)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 3 linked practice questions, and unlimited timed mock exams are included with the MuleSoft Platform Architect pack (USD $19): https://www.certifyforce.com/practice-exams