# REST user accounts **URL:** \ **Category:** Forum\ **Tags:** rest\_api, device-management\ **Created:** [June 12, 2025, 5:00pm UTC](https://community.cumulocity.com/t/rest-user-accounts/12354 "2025-06-12T17:00:48Z")\ **Posts on this page:** 1\ **Showing post:** 2
**Author:** ![Stefan\_Witschel](https://dub1.discourse-cdn.com/flex005/user_avatar/community.cumulocity.com/stefan_witschel/32/31955_2.png) [@Stefan\_Witschel](https://community.cumulocity.com/u/Stefan_Witschel)\ **Post date:** [June 12, 2025, 5:21pm UTC](https://community.cumulocity.com/t/rest-user-accounts/12354/2 "2025-06-12T17:21:33Z")
If the single Cumulocity user used in your backed has global access to Inventory, any potential user could see & manage devices they shouldn’t if you are not handling that in your backend code. Also it’s kind of bad practice to store credentials somewhere to access C8Y. If both users have global access on Inventory and also identical permissions, it doesn’t matter so much (but I doubt this is the case for all users in your case). The backend should ideally use service-users with permissions which are defined in your application/microservice manifest or forward the user credentials / session of the user to authenticate. > [@Easy & secure 3rd Party Application access to Cumulocity IoT](https://community.cumulocity.com/t/easy-secure-3rd-party-application-access-to-cumulocity-iot/5197): > > Overview Cumulocity IoT does not have an API-key functionality which can be used to integrate 3rd party application. Still, it comes with a comprehensive user & role management combined with a very fine granular access management. The most obvious but less secure way to integrate 3rd party applications is to create a technical user in each tenant and use these credentials to access Cumulocity IoT. There are multiple downsides of this approach: In tenants were SSO is configured you don’t want… --- _[View the full topic](https://community.cumulocity.com/t/rest-user-accounts/12354)._