How to create read-only Bynder API credentials, add them to Medialake, and understand exactly what access is granted.

What to expect

Bynder is connected with API credentials that you create inside your own Bynder portal. Unlike most OAuth integrations, there is no Bynder sign-in or consent screen during setup: nobody is redirected to Bynder to log in. Instead, a Bynder administrator creates the credentials, a Medialake administrator enters them into the Bynder integration settings, and Medialake authenticates to your portal server-side from then on.

Bynder supports two credential types, and Medialake accepts either:

OAuth 2.0 Client Credentials (recommended) — a Client ID and Client Secret from a Bynder OAuth app. Medialake exchanges them for short-lived access tokens automatically.
Permanent token — a single long-lived token from Bynder's Permanent Tokens settings.

In Bynder, both credential types act on behalf of an assigned user: the credentials inherit that user's permissions, and can never see more than that user can see. We follow the principle of least privilege: the recommended setup uses a dedicated read-only user and only read scopes. The Bynder connector only reads content — it lists brands and collections, reads asset metadata, retrieves thumbnails, and downloads selected file content for syncing. It does not create, edit, tag, share, or delete anything in Bynder.

 Bynder administrator          Medialake               Bynder
      │  create read-only API user │                        │
      │  and OAuth app or token    │                        │
      │────────────────────────────────────────────────────▶│
      │                            │                        │
 Medialake administrator           │                        │
      │  enter credentials in      │                        │
      │  integration settings      │                        │
      │───────────────────────────▶│                        │
      │                            │  exchange Client ID    │
      │                            │  + Secret for token    │
      │                            │───────────────────────▶│
      │                            │  short-lived token     │
      │                            │◀───────────────────────│
      │  choose brands and         │                        │
      │  collections to sync       │                        │
      │───────────────────────────▶│  read-only requests    │
      │                            │───────────────────────▶│

Before you begin

You will need:

A Bynder administrator account, to create the API user and credentials
Your Bynder portal URL, for example https://yourcompany.bynder.com (custom domains work too)
Administrator privileges in Medialake, to open the Bynder integration settings

>Keep the credentials private. The Client Secret and permanent token are shown by Bynder only once. Store them in an approved password manager or secret-management system. Do not email them, paste them into a support ticket, or commit them to source control. Medialake stores the values you enter encrypted at rest.

Step 1: Create a read-only API user in Bynder

Bynder credentials inherit the permissions of the user they are assigned to, so the assigned user — not the credential — defines what Medialake can access.

Log in to Bynder as an administrator.
Go to Settings → Users & rights → User management.
Create a dedicated user, for example medialake_readonly.
Assign the user to a Permission Profile that has only view or download rights for the assets and collections Medialake should sync. Do not give it manage, upload, or delete permissions.

Using a dedicated user rather than a personal account keeps the connection independent of any individual, and makes its access easy to review and revoke.

Step 2, option A (recommended): create an OAuth 2.0 app

This generates a Client ID and Client Secret using Bynder's Client Credentials flow.

In Bynder, go to Settings → Advanced settings → Portal settings.
Select OAuth Apps from the left-hand menu.
Click Register new application and give it a recognisable name, such as Your Company — Medialake.
Grant type: select Client Credentials. No redirect URI is needed for this grant type.
Assigned user: search for and select the read-only user from Step 1.
Scopes: select only the read scopes below.
Click Register, then copy the Client ID and Client Secret immediately. Bynder shows the secret only once; if it is lost it must be regenerated.

Scope	How Medialake uses it
`current.user:read`	Identify the connected account during the authentication handshake.
`meta.assetbank:read`	List the brands in your asset bank, which Medialake presents as folders to sync.
`asset:read`	List assets, read their metadata, retrieve thumbnails, and download selected file content.
`collection:read`	List collections and the assets they contain.

Leave every write, workflow, admin, and analytics scope unselected. Medialake does not request or use them.

Step 2, option B: create a permanent token

Use this only if your organisation prefers a single long-lived token over the Client Credentials flow.

In Bynder, go to Settings → Advanced settings → Portal settings.
Select Permanent Tokens.
Click Add new token.
Description: give it a recognisable name, such as Medialake read-only.
Assigned user: select the read-only user from Step 1.
Scopes: select only the read scopes listed in option A.
Click Create token and copy the token now. It is shown only once and cannot be viewed or edited later.

Permanent tokens do not expire. They remain valid until deleted in Bynder, so record where the token is used and include it in your credential-rotation reviews.

Step 3: Add the credentials to Medialake

You need administrator privileges in Medialake for this step.

In Medialake, open Administration → Integrations from the sidebar.
Find the Bynder integration and click Edit.
Open the Settings tab and click Create New Setting.
Under Bynder Credentials Type, choose the option matching Step 2:

- Bynder OAuth2 — enter the Bynder Client ID, Bynder Client Secret, and Bynder Domain Url.

- Bynder Bearer Token — enter the Bynder Bearer Token and Bynder Domain Url.

Save the setting.

The Bynder Domain Url is the full URL of your Bynder portal, including https://, for example:

https://yourcompany.bynder.com

Enter each value without leading or trailing spaces. Medialake validates that all required fields are present and that the domain URL is a valid URL before the setting is saved.

Connect Bynder and choose what to sync

With the setting in place, add Bynder as a source in Medialake. There is no Bynder login screen: Medialake authenticates in the background using the saved credentials — with OAuth2 it requests an access token from https://your-portal/v6/authentication/oauth2/token, and with a permanent token it uses the token directly.

Nothing is synced automatically. Bynder brands appear as folders, and you explicitly select the brands, and optionally the collections, that Medialake should sync. Content outside your selection is not imported.

Limiting what Medialake can access

Two layers control what the connection can reach, and Bynder enforces both:

The assigned user's permissions. The credentials can only access what the assigned user can access. Restricting that user's Permission Profile is the strongest control.
The credential's scopes. Read-only scopes mean that even a compromised credential could not modify or delete content.

Selecting brands in Medialake controls what is actively synced, but it does not narrow the credential itself. For the narrowest possible connection, give the assigned user access only to the brands and collections that need syncing, and review its permissions periodically.

What Medialake can and cannot do

With the configuration above, Medialake can:

Confirm the connected account's identity
List the brands and collections visible to the assigned user
Read asset metadata such as names, extensions, sizes, dates, and metaproperties
Retrieve thumbnails and preview images
Download the content of selected assets into Medialake

Medialake cannot:

See any Bynder user's password
Access brands, collections, or assets the assigned user cannot access
Upload, replace, edit, tag, or delete assets
Create or change collections, metaproperties, or workflows
Manage Bynder users, permission profiles, or portal settings

Staying connected

With OAuth2 credentials, access tokens are short-lived. Medialake requests a fresh token automatically whenever one expires, using the stored Client ID and Client Secret — no re-authorisation or user action is ever needed.

With a permanent token, the same token is used until it is deleted in Bynder.

The connection stops working, and is marked unauthorized in Medialake, if the Client Secret is regenerated, the OAuth app or permanent token is deleted, or the assigned user is deactivated or loses access. Update the integration setting with new credentials to restore it.

Medialake also paces its requests to stay within Bynder's API rate limit of 4,500 requests per 5 minutes, backing off automatically when the limit is near. Large first-time syncs may take a while for this reason; this is expected.

Revoking access

To revoke Medialake's access from Bynder:

OAuth app: in Settings → Advanced settings → Portal settings → OAuth Apps, delete the app created for Medialake, or regenerate its secret.
Permanent token: in Settings → Advanced settings → Portal settings → Permanent Tokens, delete the token.
Alternatively, deactivate the assigned user, which invalidates the permissions behind either credential type.

Disconnect or delete the Bynder source in Medialake as well if it should no longer sync.

Troubleshooting

Symptom	What to check
"Domain URL format is invalid" when saving settings	Enter the full portal URL including `https://`, with no spaces, for example `https://yourcompany.bynder.com`.
"All settings must be present" when saving	Every field for the chosen credentials type is required. Check that no field was left empty.
The connection fails immediately or becomes unauthorized	The Client ID and Secret, or the token, may be wrong, regenerated, or deleted — or the assigned user was deactivated. Re-create the credentials in Bynder and update the setting in Medialake.
An expected brand or collection is missing	The assigned user's Permission Profile does not include it. Adjust the user's permissions in Bynder, then re-open the sync selection.
Assets appear but a file will not download	Confirm the assigned user has download rights for that asset in Bynder.
A large sync is progressing slowly	Medialake is pacing requests to respect Bynder's rate limit of 4,500 requests per 5 minutes. No action is needed.
The Client Secret or token was lost	Bynder shows these values only once. Regenerate the secret or create a new token, then update the Medialake setting.

If the issue continues, contact [email protected] with your portal URL, the credentials type in use, and the error message. Do not include the Client Secret or token.

Bynder — Authentication