Authentication

DigiCert® ONE API integrations rely on service users. Service users are non-interactive identities created specifically for making API calls.

You can authenticate a service user using two primary methods:

What is a service user?

A service user is essentially a credential container. Think of it as a headless account holding only the permissions your integration needs. Service users:

• Authenticate using API keys or client certificates.
• Cannot sign in to the user interface.
• Are created in Account Manager (through browser or API).

Create a service user (UI)

1. Sign in to .
2. In the Manager menu (grid at top right), select Account.
3. In the Account menu, select Access > Service users.
4. Select Create service user.
5. Enter service user details:
   1. Friendly name Enter a unique display name. The name must include only letters, numbers, spaces, dashes, and underscores. Actions are logged under this name.
   2. Optional: Description Add additional information about the service user. This description only appears in the Service user details.
   3. Optional: End date Specify an expiration date (UTC). For example, selecting January 12, 2026 means the service user expires at 23:59:59 UTC.

      Tip

      Update API integrations using this token ID before expiration to prevent disruptions. If needed, you can extend the expiration date later.
   4. Email Provide the email address of the person managing this service user’s credentials. DigiCert ONE does not send emails to this address, so communicate any necessary details directly.
   5. Accounts that can use this service user Select the accounts that can use this service user for their API integrations.
   6. DigiCert ONE Manager access Assign one or more DigiCert ONE Managers. The service user can access the API for each assigned manager
6. Assign accounts and access:
   • In the Accounts that can use this service user field, select the accounts this service user needs to interact with.
   • In the DigiCert ONE Manager access field, assign one or more managers the service user will access via the API.
7. Select Next.
8. On the Roles and permissions page, select the user roles for each manager assigned to the service user.

   Tip

   Only assign roles necessary for the task or integration. If required, you can update these roles later.
9. Select Create service user.
10. In the Service user token ID window, copy the ID and save it securely.

    Important

    The token ID is displayed only once and cannot be recovered if lost.
11. After saving the token ID, select Close.

API key authentication

Use an API key for straightforward, stateless authentication.

Make API requests:

curl -X GET \
-H "x-api-key: <SERVICE_USER_KEY>" \
https://one.digicert.com/account/api/v1/user

Rotate and scope keys:

• Treat keys like passwords. Store securely and rotate as needed.
• Assign only roles necessary for each service user (least privilege).

Certificate authentication (mTLS)

mTLS replaces API keys with a secure X.509 digital client certificate for verifying your identity as a service user during API requests.

Create a client authentication certificate (UI)

1. Sign in to .
2. In the Manager menu (grid at top right), select Account.
3. In the Account menu, select Access > Service users.
4. In the Friendly name column, select the service user’s friendly name.
5. Navigate to the Client authentication certificates section.
6. Select Create client authentication certificate.
7. Provide the following information:
   1. Nickname This is the friendly name shown on the Service user details page. The name must be unique and may only include letters, numbers, spaces, dashes, and underscores.
   2. End date Enter an expiry date for the certificate.

      Tip

      Make note of the expiration date. You must generate a new certificate and update all API integrations using the certificate before it expires. If you don’t, the API token integrations will stop working.
   3. Encryption Select an encryption algorithm to use for securing communications. DigiCert recommends AES (Advanced Encryption Standard), which is the default selection.
   4. Signature hash algorithm Select a hash function to use for verifying data integrity.
8. Select Generate certificate.
9. Copy the certificate’s password and store it in a secure location.

   Important

   This password is required for installation and API requests. You will not be able to retrieve it later.
10. Select Download certificate and save the certificate.

    Note

    You cannot download the certificate again. If lost, you must generate a new certificate.
11. Select Close.

API requests with mTLS

With curl, your request looks like:

curl --cert /path/auth-cert.pem --key /path/to/auth-key.pem \
  https://clientauth.one.digicert.com/account/api/v1/user

Use the clientauth. hostname and omit the x-api-key header.

API troubleshooting basics

What’s next?

• Make your first API call Walk through prerequisites, environment setup, and pagination.
• Error handling & rate limits Decode 401/403 responses and implement retry strategies.