# Aembit API

> This page describes how to configure Aembit to enable a Client Workload to authenticate and interact with the Aembit API.

[Aembit](https://aembit.io/) is a Workload Identity and Access Management (IAM) Platform for managing access between workloads—Workload IAM. The Aembit API enables Client Workloads, such as CI/CD tools, to authenticate and interact with Aembit without relying on long-lived secrets. Aembit achieves this secret-less authentication through workload attestation via a Trust Provider. By configuring Client Workloads with the appropriate trust and credential components, Aembit ensures secure, role-based access to your tenant’s API resources.

On this page you can find the Aembit configuration required to work with the Aembit service as a Server Workload using the REST API.

> **Prerequisites**
>
> Before proceeding with the configuration, make sure you have configured your Aembit Tenant.
>
> For more detailed information on how to use the Aembit API, please refer to the [official Aembit documentation](/dev-guide/api/). :::
>
> ## Credential Provider configuration
>
> 1. Create a new Credential Provider.
>
>    * **Name** - Choose a user-friendly name.
>    * **Credential Type** - [Aembit Access Token](/user-guide/access-policies/credential-providers/aembit-access-token)
>    * **Audience** - Auto-generated by Aembit, this is a tenant specific server hostname used for authentication and connectivity with the Aembit API. Copy this value for use in the configuration that follows.
>    * **Role** - Choose a role with the appropriate permissions that align with your Client Workload’s needs. Follow the principle of least privilege, assigning the minimum necessary permissions for the task. If needed, you can [create new customer roles](/user-guide/administration/roles/add-roles).
>    * **Lifetime** - Specify the duration for which the generated access token remains valid.
>
> ## Server Workload configuration
>
> 1. Create a new Server Workload.
>
> * **Name** - Choose a user-friendly name.
>
> 2. Configure the service endpoint:
>
> * **Host** - Enter the previously copied audience value.
> * **Application Protocol** - HTTP
> * **Port** - 443 with TLS
> * **Forward to Port** - 443 with TLS
> * **Authentication method** - HTTP Authentication
> * **Authentication scheme** - Bearer
>
> ## Access Policy
>
> This page covers the Server Workload and Credential Provider configuration, which differs across Server Workload types. To complete the setup, create an Access Policy that lets a Client Workload access the Aembit Server Workload. Associate that policy with the Credential Provider, Trust Provider, and any optional Access Conditions.
>
> ## Client Workload configuration
>
> Aembit now handles the credentials required to access the Aembit API as a Server Workload, eliminating the need for you to manage them directly. You can remove any previously used credentials from the Client Workload.
>
> ## Required features
>
> * You must enable the [TLS Decrypt](/user-guide/deploy-install/advanced-options/tls-decrypt/configure-tls-decrypt) feature if the Client Workload uses the Agent Proxy to access the Aembit API.