Identity & Access Management (IAM): Developer Insights and Best Practices

Whether you're prototyping your first HERE integration or managing enterprise deployments across multiple environments, understanding the HERE Identity & Access Management (IAM) model helps you avoid common authentication errors and reduce security risk.

This article compiles the most frequently asked IAM questions from the HERE developer community, along with the recommended practices behind each answer.

How do I choose between API Keys and OAuth 2.0?

Choosing the right authentication method depends on where your application runs and the level of security it requires.

Best practices

• Use API Keys for simple applications and rapid prototyping.

• Protect browser-based applications by restricting API Keys with Trusted Domains.

• Use OAuth 2.0 for backend services where credentials can remain secure.

• When accessing HERE Platform resources such as catalogs, pipelines or other IAM-managed resources, use

  OAuth 2.0 authentication.

How do I generate an OAuth 2.0 access token?

A common question is why an application that successfully authenticates with an API Key fails when requesting an OAuth 2.0 access token. Although both authentication methods can be configured for the same app, OAuth 2.0 requires its own set of credentials and authentication flow.

Before troubleshooting, verify the following:

• You're using the app's OAuth 2.0 credentials (Access Key ID and Access Key Secret), not the API Key.

• The token request is sent to the correct endpoint:

https://account.api.here.com/oauth2/token

• The request includes the required Authorization header generated from your OAuth credentials.

• The request uses the client_credentials grant type.

• The Content-Type header is set to application/x-www-form-urlencoded.

If token requests continue to fail:

• Double-check that you're using OAuth credentials generated for the same app.

• Verify the request format against the official examples.

• Review the returned error code and message, as they often indicate the root cause—for example, a missing Authorization header, invalid credentials, or an invalid OAuth signature.

How do I authenticate securely without exposing credentials?

Instead of embedding API Keys in client applications:
• Use OAuth 2.0 Bearer Tokens
• Call HERE APIs from your backend
• Keep secrets on the server

How do I find, generate, or regenerate an API Key?

API credentials can be managed through Access Manager. Navigate to: Access Manager → Apps → Credentials. From there you can:

• Generate API keys

• Create OAuth credentials

• Rotate compromised keys

• Delete unused credentials

What should I do if my API key is compromised?

Immediately:

• Revoke the compromised API key

• Generate a replacement API key

• Update your application to use the new key

• Review recent usage for any unauthorized activity

To help prevent future incidents:

• Restrict browser-based API Keys using Trusted Domains where applicable.

• Consider using OAuth 2.0 for server-side applications, where credentials can be kept confidential.

How can I securely rotate credentials without downtime?

For production applications, rotating API keys should be a regular security practice rather than a one-time response to a compromised credential.

Recommended approach

Use a staged rollout:

• Generate a new API key

• Update your application or deployment to use the new key

• Verify that authentication succeeds

• Revoke the old key only after confirming the new key is in use

For larger deployments, you can automate this process using the Identity and Access Management Authentication API v1.1. The API lets you:

• List an application's existing API keys

• Generate a new API key

• Delete obsolete keys

• Integrate key rotation into deployment pipelines or scheduled automation

A common pattern is to use a dedicated management app with OAuth 2.0 credentials to manage API keys for other applications, rather than using the application's own credentials.

Why am I getting authentication or authorization errors?

Common causes include:

• Invalid or disabled API key

• Expired OAuth access token

• Invalid OAuth signature or credentials

• Missing permissions on the requested resource

• Resource not linked to the current project

• Missing project or organization entitlements

• Incorrect authentication method

Troubleshooting checklist:

• Verify the credential

• Confirm the correct authentication method

• Check token expiration

• Review application permissions

• Check the error response's cause field, which often explains exactly why access was denied

How should I organize applications for different environments?

Avoid using the same credentials across development, testing, and production. Instead, create separate apps for:

• Development

• Testing

• Production

This improves security and simplifies credential management.

What's the difference between organizations, groups, projects and apps?

Understanding the IAM hierarchy helps simplify access management.

• Organization: contains users, groups, projects and applications. Defines the overall security boundary

• Groups: simplify permission management

• Projects: organize HERE Platform resources such as catalogs and pipelines

• Services apps: provide the credentials your applications use to authenticate

How do I enable Single Sign-On (SSO) for my organization?

A common question in the community is why the Configure SSO option is unavailable even when the user is an Organization Admin. Being an Organization Admin is mandatory, but it isn't the only requirement.

To configure SAML-based Single Sign-On, your organization must also be eligible for the feature. At the time of writing, SSO is available to:

• Organizations with Premium Support or Premium Success

• Platinum Partners

• Gold Partners with the SSO premium add-on

If your organization is on an Essential or Advanced Support plan, the SSO option won't be available, even if you're an Organization Admin.

Troubleshooting checklist:

• Verify that you're an Organization Admin

• Confirm that your organization is subscribed to an eligible support plan

• If your organization is eligible but SSO is still unavailable, contact HERE Support

Is there a limit to how many apps a group can access?

Organizations managing a large number of applications may eventually encounter limits when assigning IAM permissions. By default, groups and users can only be associated with a limited number of apps. If you receive a "limit reached" error while granting access, you've likely reached one of the default IAM limits.

For organizations with large-scale deployments, HERE offers Premium IAM features that can increase these default limits.

Recommended approach:

• Design your IAM structure with future growth in mind

• Use Groups to simplify permission management rather than assigning users individually

Can I use multiple API Keys to increase my rate limits?

No. Creating multiple API Keys doesn't increase your service quotas. Usage limits are determined by your account, subscription or service plan rather than by the number of API Keys.

How do I view my rate limit rules?

If you need to inspect the rate limits configured for an application or identity, you can use the Rate Limit Rules API. A few common pitfalls when calling this API are:

• Authenticate using an OAuth 2.0 access token rather than an API Key

• Use the correct Rate Limit Rules API endpoint

• URL-encode the identityHrn value when including it in the request path

For example, an identity HRN such as:

hrn:here:authorization::orgid:app/my-app

Copy

must be URL-encoded before being sent as part of the request.

How can I add multiple Trusted Domains using the Authentication API v1.1?

For applications deployed across many customer websites, manually managing Trusted Domains through the Platform Portal can become difficult.

Recommended approach

Use the Authentication API v1.1 or the HERE CLI to programmatically manage Trusted Domains. Although the Platform Portal allows you to add up to 20 domains through the UI, an application can have up to 3,000 Trusted Domains. Additional domains should be managed using the CLI or API.

This approach allows you to:

• Automate Trusted Domain management

• Add and update domains as part of your deployment process

• Manage large numbers of customer domains without relying on the web interface

Conclusion

Strong Identity & Access Management isn't a one-time configuration, it's an ongoing practice. Applying these practices helps keep HERE Platform integrations secure, simplifies credential management and makes applications easier to operate as they grow over time into a more secure, easier-to-manage HERE Platform application. Bookmark this guide as a reference the next time an authentication error, SSO question or credential rotation task comes up.

We encourage you to join the conversation, ask questions and share your learnings in the developer community in the developer community. It continues to be one of the strongest assets in the HERE developer ecosystem.