# REST user accounts **URL:** \ **Category:** Forum\ **Tags:** rest\_api, device-management\ **Created:** [June 12, 2025, 5:00pm UTC](https://community.cumulocity.com/t/rest-user-accounts/12354 "2025-06-12T17:00:48Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![ac8y](https://avatars.discourse-cdn.com/v4/letter/a/71c47a/32.png) [@ac8y](https://community.cumulocity.com/u/ac8y)\ **Post date:** [June 12, 2025, 5:00pm UTC](https://community.cumulocity.com/t/rest-user-accounts/12354/1 "2025-06-12T17:00:48Z")
Hello, I’m building an app where users are able to access and manage their devices through Cumulocity. My backend connects to the REST endpoint using a single Cumulocity user account. Is this approach acceptable, or should I be creating individual Cumulocity user accounts for each of my users instead? Thanks! ---
**Author:** ![Stefan\_Witschel](https://dub1.discourse-cdn.com/flex005/user_avatar/community.cumulocity.com/stefan_witschel/32/31955_2.png) [@Stefan\_Witschel](https://community.cumulocity.com/u/Stefan_Witschel)\ **Post date:** [June 12, 2025, 5:21pm UTC](https://community.cumulocity.com/t/rest-user-accounts/12354/2 "2025-06-12T17:21:33Z")
If the single Cumulocity user used in your backed has global access to Inventory, any potential user could see & manage devices they shouldn’t if you are not handling that in your backend code. Also it’s kind of bad practice to store credentials somewhere to access C8Y. If both users have global access on Inventory and also identical permissions, it doesn’t matter so much (but I doubt this is the case for all users in your case). The backend should ideally use service-users with permissions which are defined in your application/microservice manifest or forward the user credentials / session of the user to authenticate. > [@Easy & secure 3rd Party Application access to Cumulocity IoT](https://community.cumulocity.com/t/easy-secure-3rd-party-application-access-to-cumulocity-iot/5197): > > Overview Cumulocity IoT does not have an API-key functionality which can be used to integrate 3rd party application. Still, it comes with a comprehensive user & role management combined with a very fine granular access management. The most obvious but less secure way to integrate 3rd party applications is to create a technical user in each tenant and use these credentials to access Cumulocity IoT. There are multiple downsides of this approach: In tenants were SSO is configured you don’t want… ---
**Author:** ![Andre\_Eickler1](https://dub1.discourse-cdn.com/flex005/user_avatar/community.cumulocity.com/andre_eickler1/32/31982_2.png) [@Andre\_Eickler1](https://community.cumulocity.com/u/Andre_Eickler1)\ **Post date:** [June 12, 2025, 6:02pm UTC](https://community.cumulocity.com/t/rest-user-accounts/12354/3 "2025-06-12T18:02:57Z")
To add to Stefan’s comment: If your users can do changes and you use a single user for the Cumulocity API, you would not be able to identify who did what change in Cumulocity (e.g., who sent a command to a device) unless you also completely handle that in your application. This would also apply to a solution where your backend uses service users. Cheers, André ---
**Author:** ![david.presuhn](https://dub1.discourse-cdn.com/flex005/user_avatar/community.cumulocity.com/david.presuhn/32/32123_2.png) [@david.presuhn](https://community.cumulocity.com/u/david.presuhn)\ **Post date:** [June 12, 2025, 6:15pm UTC](https://community.cumulocity.com/t/rest-user-accounts/12354/4 "2025-06-12T18:15:01Z")
Putting on my Security hat… I always want users to authenticate. Having a generic account tells you that someone did the thing but you have no idea who did the thing. That leaves no audit traceability. Also, once people leave or change roles, if they know the shared account credentials, those credentials need to be changed or otherwise you’ve got a potentially unhappy ex-employee with some kind of access to your system. That can cause trouble if they are severely unhappy. ---
**Author:** ![ac8y](https://avatars.discourse-cdn.com/v4/letter/a/71c47a/32.png) [@ac8y](https://community.cumulocity.com/u/ac8y)\ **Post date:** [June 12, 2025, 8:46pm UTC](https://community.cumulocity.com/t/rest-user-accounts/12354/5 "2025-06-12T20:46:43Z")
Hi all, I appreciate the responses! I wanted to clarify that users don’t have direct access to Cumulocity. They are authenticated and authorized by our backend which uses the single Cumulocity account to create operations and device subscriptions through the REST api. The credentials are stored securely. Observability is not ideal with a single user, but all operations are tracked on the backend and we could also add a user id to Cumulocity operations. Are there any other limitations such as per user rate limits that I should be aware of if continuing with this approach?