CrowdStrike

C Falcon platform API (OAuth2 API clients)

Every Falcon API call, SDK and the Terraform provider start from a static API client ID and secret swapped for a 30-minute token; there is no OIDC or workload identity path. Clients are scoped and API-resettable, but secrets do not expire, show no last use, and are not GitHub partner-revoked. Into your cloud, CSPM registration is keyless on AWS, Azure and GCP, but OCI and most container registry connections still use static keys.

Docs: developer.crowdstrike.com · Checked 2026-10-22 · source YAML · dispute via PR

Inbound C

How a workload running anywhere authenticates to this product.

OAuth2 client_credentials: a static API client ID and secret created under API Clients & Keys are POSTed to /oauth2/token for a bearer token that lasts 30 minutes. No federation, token exchange or workload identity path exists.

developer.crowdstrike.com checked 2026-10-22
“All API access requires OAuth2 credentials (client_id and client_secret) created in the Falcon console under Support and resources > API Clients & Keys.”
developer.crowdstrike.com checked 2026-10-22
“Tokens expire after 30 minutes.”
developer.crowdstrike.com checked 2026-10-22
“All API requests require a valid bearer token generated through this collection.”
developer.crowdstrike.com checked 2026-10-22
“The API client secret to authenticate your API requests.”
raw.githubusercontent.com checked 2026-10-22
“`client_secret` (String, Sensitive) Falcon Client Secret used for authenticating to the CrowdStrike APIs.”
developer.crowdstrike.com checked 2026-10-22
“Obtain an access token using `Request-FalconToken` with your API Client ID and Secret.”

The token endpoint takes only client_id, client_secret and an optional MSSP member_cid; no grant for a JWT assertion or an external OIDC token is documented in the API reference, the SDKs (FalconPy, PSFalcon, gofalcon), the Terraform provider or the Falcon MCP server. Grade C under the precedent that OAuth client_credentials with a client secret is a short-lived token from a static root. The "Federated Connections" API collection is NG-SIEM search federation to external LogScale clusters (a view_token you supply), not authentication federation. CreateAPIClient accepts redirect_uris and a type, suggesting other OAuth flows for apps, but none removes the client secret for a workload. Falcon Foundry functions running inside Falcon would be ambient identity on the vendor's platform and would not earn A anyway. CrowdStrike's own API client docs (crowdstrike-api-introduction-for-developers) are behind the Falcon login and not publicly verifiable.

Outbound B

How this product reaches into your cloud, repos, or other SaaS.

Falcon Cloud Security registration is keyless on AWS (IAM role with external ID, assumed via a CrowdStrike intermediate role), Azure (CrowdStrike's multi-tenant app as a service principal in your tenant) and GCP (Workload Identity Federation pool trusting CrowdStrike's AWS role or Google service account). OCI registration uses a long-lived API signing key on an IAM user, and container registry connections other than ECR take passwords, tokens, an Azure certificate or a GCP service-account JSON key.

developer.crowdstrike.com checked 2026-10-22
“`external_id` (String) The external ID used to assume the AWS IAM role”
developer.crowdstrike.com checked 2026-10-22
“`intermediate_role_arn` (String) The ARN of the intermediate role used to assume the AWS IAM role”
developer.crowdstrike.com checked 2026-10-22
“`cs_azure_client_id` (String) Client ID of CrowdStrike's multi-tenant application in Azure.”
developer.crowdstrike.com checked 2026-10-22
“The module enables keyless authentication through GCP's Workload Identity Federation and provides security monitoring capabilities including asset inventory and optional real-time log ingestion for threat detection.”
developer.crowdstrike.com checked 2026-10-22
“Numeric unique ID of CrowdStrike's shared service account. Required when CrowdStrike authenticates via GCP OIDC.”
developer.crowdstrike.com checked 2026-10-22
“Associates an API key with the created user”
developer.crowdstrike.com checked 2026-10-22
“`api_public_key`: Public key for API access, generated by Falcon Cloud Security”
developer.crowdstrike.com checked 2026-10-22
“Create, update, delete, and validate OCI tenancy accounts, rotate keys, and retrieve setup scripts.”
developer.crowdstrike.com checked 2026-10-22
“`aws_iam_role` (String) AWS IAM role ARN. Required for: `ecr`.”
developer.crowdstrike.com checked 2026-10-22
“`service_account_json` (Attributes) GCP service account JSON. Required for: `gar`, `gcr`.”
developer.crowdstrike.com checked 2026-10-22
“`password` (String, Sensitive) Password, API key, or access token. Required for: `dockerhub`, `docker`, `github`, `gitlab`, `icr`, `artifactory`, `acr` (password auth), `mirantis`, `oracle`, `openshift`, `quay.io`, `nexus`, `harbor`.”

Checked (from the public Developer Center API reference and the Terraform provider and modules): CSPM/Cloud Security registration on AWS (cross-account role with external ID plus agentless-scanning and DSPM roles; keyless), Azure (service principal for CrowdStrike's multi-tenant app with Graph permissions and admin consent; keyless), GCP (a WIF pool in your project that trusts CrowdStrike's AWS STS role or its Google service account via OIDC; keyless), OCI (a Resource Manager stack creates an IAM user and attaches an API signing key whose key pair Falcon generates; only the public key crosses, but the private key is a long-lived credential CrowdStrike holds, with a rotate-key API and a key_age field), and container image registry connections (ECR via IAM role plus external ID; ACR via password or service-principal certificate; GAR/GCR via a service-account JSON key; Docker Hub, GitHub, GitLab, Artifactory, Harbor, Quay and others via username plus password or token). B because the three big clouds are keyless but OCI and most registries are not. Not graded here: SaaS Security and Next-Gen SIEM third-party connectors (per-app OAuth or API keys configured in the console, not publicly documented in detail) and Falcon Data Replicator, which is CrowdStrike-hosted S3 that you pull from rather than a reach-in.

Hygiene for any static credential the product still issues

✗ Expiry enforceable	CreateAPIClient and UpdateAPIClient take only description, is_confidential, name, redirect_uris, scopes and type; there is no expiry or lifetime field, and no public document describes a secret expiry or a CID-wide maximum-lifetime policy. A secret lives until someone resets it or deletes the client. The in-console API documentation is login-walled, so an unpublished expiry setting is not publicly verifiable; graded on what can be cited. developer.crowdstrike.com checked 2026-10-22 “Reset existing API Client(s)'s secret based on API Client ID(s) provided as request parameter(s) 'ids'.”
✓ Rotation via API	The API Clients collection (scope Api Client Mgmt) creates, lists, updates, deletes and resets the secret of API clients, so rotation can be scripted. Resetting replaces the secret in place, so a zero-downtime rotation means creating a second client first. developer.crowdstrike.com checked 2026-10-22 “Reset existing API Client(s)'s secret based on API Client ID(s) provided as request parameter(s) 'ids'.” developer.crowdstrike.com checked 2026-10-22 “Delete existing API Client(s) based on API Client ID(s) provided as request parameter(s) 'ids'.”
✓ Scoped keys	An API client is its own principal, not a user's key, and carries an explicit list of per-API read/write scopes (every operation in the reference names the scope it needs). Scopes are per API collection, not per host group or resource, but that is still a least-privilege machine principal under the rubric. developer.crowdstrike.com checked 2026-10-22 “It is highly recommended that you create a dedicated API client with only the required scopes.” developer.crowdstrike.com checked 2026-10-22 “Get all available scopes for customer.”
✗ Last-used visible	The public API reference exposes created and last-modified metadata for API clients but no last-used field, and the response schema for GetAPIClients is not published. Whether the console's API Clients & Keys page shows last use is not publicly verifiable (login-walled); API activity can be found in audit logs, which is not the same as a per-key last-used view. developer.crowdstrike.com checked 2026-10-22 “Possible values for sort by field includes id, name, created_by, updated_by, created_timestamp, last_modified.”
✗ Leak revocation	CrowdStrike does not appear in GitHub's supported secret scanning patterns table at all, so a Falcon API client secret pushed to a public repo is neither alerted on by a GitHub pattern nor reported to CrowdStrike. docs.github.com checked 2026-10-22

Notes

One card for the Falcon platform API across all its service collections; the Terraform provider, FalconPy, PSFalcon and gofalcon all authenticate the same way. Two of five hygiene checks pass, which would not matter at grade C but explains what to fix: a secret lifetime with an enforceable maximum, a last-used timestamp, and a prefixed secret enrolled in GitHub's partner program. Inbound moves to B or A only if /oauth2/token accepts a federated assertion (GitHub Actions OIDC, cloud workload identity, or a bring-your-own issuer). Outbound moves to A if OCI registration and the registry connectors (GAR, ACR, GitHub, GitLab) move to federation the way the AWS, Azure and GCP registrations already have. Falcon sensors use a CID and optional installation token, which is endpoint enrollment rather than API access and is not graded here.

Badge

[![wif.tax grade](https://wif.tax/badge/crowdstrike-falcon-api.svg)](https://wif.tax/p/crowdstrike-falcon-api/)