---
title: Clients
id: "en:tpm:ROOT:clients.adoc"
site: en
component: tpm
module: ROOT
version: 3.0
lang: en
url: "https://help.rtlscloud.io/en/tpm/3.0/clients.html"
source_repo: "https://github.com/iot-invent/rtlscloud-tpm.git@3.0.x"
source_path: docs/en/modules/ROOT/pages/clients.adoc
---

# Clients

The credentials third-party systems use to receive the position, decision and telemetry events of tags. The application delivers events continuously; a third-party system does not have to query anything.

## Reference

![Clients](_images/tpm_app_clients.png)

| Module | Description |
| --- | --- |
| ![refresh](_images/refresh.svg) Refresh | Reloads the list, including the connection status |
| ![plus](_images/plus.svg) New | Creates a credential |
| ![edit](_images/edit.svg) Edit | Opens the selected credential for editing |
| ![delete](_images/delete.svg) Delete | Removes the credential. An existing connection is closed immediately |
| ![info](_images/info.svg) Info | Number of credentials shown |

## Attributes

| Field | Type | Description |
| --- | --- | --- |
| Name | Text | Display name, usually the system that uses this credential |
| Client ID | Text | Generated when saved. Copyable to the clipboard via the icon |
| Client Secret | Password | The credential’s password. Shown only when entered, never again afterwards |
| Groups | Multi-select | The groups whose tag events this credential may receive |
| Notes | Text | Free text |
| Tenant | Selection | Settable only when creating |
| Status | Display | Whether the credential currently holds a connection |

> **IMPORTANT:** The client secret cannot be viewed again after saving. Store it in the target system immediately. If it is lost, set a new one — there is no way to display the existing one.

## Authorization

A credential receives **exclusively** events of tags from the groups assigned to it.

-   Without an assigned group, the credential connects successfully and receives **nothing**. This is the most common misconfiguration.

-   A tag without a group produces events that no credential receives — see [Tag Groups](tag_groups.md).

-   The check happens per event. A credential cannot widen its scope by subscribing more broadly.

Moving a tag to another group changes who receives its events from the next message onward. The third-party system does not have to reconnect.

## Status

| Value | Meaning |
| --- | --- |
| Connected | The credential currently holds at least one connection |
| Disconnected | No connection exists |

The status is read directly from the running system when the list is refreshed, not from the database. It therefore shows the actual state.

## Several Connections of One Credential

A third-party system may use the same credential from several instances. Events are then delivered in rotation across the connections, and if one fails another takes over.

This is how a receiving system scales without its instances coordinating with each other. Note: consecutive events of **one** tag may land on different instances. If order matters, sort by the event’s timestamp in the target system.

## Disabling or Removing a Credential

Both take effect immediately — an existing connection is closed without waiting for a timeout. This is the way to revoke a credential.