Creating and Managing API Client in CrowdStrike's Console

ClientId and ClientSecret are required in order to make requests using the OAuth2.0 workflow to CrowdStrike's API client.

Before you begin, ensure you have:

• Access to the CrowdStrike Falcon Console
• Administrator privileges

• Log in to your CrowdStrike Console instance with administrative privileges.

• Go to the Support and resources > Resources and tools > API Client and keys section where an API Client can be managed.

• Create an API Client

• Provide a Client name and a related description with the following scope permissions:

  Permissions Required:

  Scope	Read	Write	Purpose
  Alerts	✅	❌	Query alert data and threat/EDR events
  Hosts	✅	✅	Query endpoint information and quarantine endpoints from network. Excluding the write permissions disables the quarantine feature.
  Assets	✅	❌	Query application data
  IOC Management	✅	✅	Query, create and delete Indicators of Compromise (IOC). Excluding the write permissions disables creating and deleting IOCs.
  Custom IOA Rules	✅	✅	Query, create, and delete Custom IOA (behavioral detection) rules. Excluding write disables creating and deleting IOAs. Distinct from IOC Management.
  Zero Trust Assessment	✅	❌	Query security posture scores
  Real Time Response	✅	✅	Establish RTR sessions and retrieve files from hosts (retrieve_file).
  Real Time Response (Admin)	❌	✅	Run scripts on hosts via execute_remote_script (RTR runscript). Also requires enabling the command in the host's Response policy — see Section 5.

• Confirm the new API Client

• Securely store the generated Client ID, Secret and Base URL

URL This is the Base URL from where the Falcon API Client credentials came. CrowdStrike Base URLs

ClientId This is the Client Id gathered in step 2

ClientSecret This is the Client Secret gathered in step 2

Note The token_url should not be set/configured when configuration the Integration.

Running scripts on a host via execute_remote_script requires two independent authorizations. The API scope from Section 3 (Real Time Response (Admin)) only permits the API call; a separate Response policy on the host controls whether the command is allowed to run. Without it, a script is accepted by the API but the host returns "runscript is disabled by policy" and produces no output.

To enable it:

1. In the Falcon console, go to Host setup and management → Response and containment → Response policies.
2. Select the host's operating system from the dropdown (Windows, macOS, or Linux).
3. Open the Response policy assigned to the hosts you want to target (for most tenants this is the platform default policy).
4. Enable the toggles for the capabilities you need, then Save:
   • Real Time Response (top-level) — must be enabled for any RTR activity.
   • Custom scripts → Custom Scripts — required for execute_remote_script (RTR runscript).
   • High risk commands → get — required for retrieve_file (usually enabled by default).

Policy changes take a short time to propagate to the endpoint before script execution succeeds.

The Response policy applied to a given host is reported by the CrowdStrike device API under device_policies.remote_response.policy_id.

• CrowdStrike OAuth2-Based APIs