---
title: Crowdstrike Falcon
slug: authentication-guides/crowdstrike-falcon
docTags: 
createdAt: 2026-01-19T16:09:00.724Z
---

# Introduction

This guide explains how to authenticate the CrowdStrike Falcon connector in Swimlane using OAuth 2.0 Client Credentials.

You will identify your cloud base URL, gather CrowdStrike OAuth credentials, and configure the connector inside Swimlane Turbine.

## Crowdstrike Access Requirements

You must have Crowdstrike Console permissions to:

- Create / View API Clients and Keys
- Assign required OAuth scopes
- Identify your Falcon cloud region
- (If applicable) access your **member CID** for MSSP environments

## Required Credentials

During setup, you will collect:

- Client ID
- Client Secret
- Base URL (depends on your Falcon cloud)
- Member CID *(optional; only for MSSP)*

# CrowdStrike Cloud Base URLs

Use the base URL specific to your Falcon region:

| **Cloud** | **Base URL**                                                                      |
| --------- | --------------------------------------------------------------------------------- |
| US-1      | [https://api.crowdstrike.com](https://api.crowdstrike.com/)                       |
| US-2      | [https://api.us-2.crowdstrike.com](https://api.us-2.crowdstrike.com/)             |
| EU-1      | [https://api.eu-1.crowdstrike.com](https://api.eu-1.crowdstrike.com/)             |
| US-GOV-1  | [https://api.laggar.gcw.crowdstrike.com](https://api.laggar.gcw.crowdstrike.com/) |
| US-GOV-2  | [https://api.us-gov-2.crowdstrike.mil](https://api.us-gov-2.crowdstrike.mil/)     |

:::hint{type="info"}
Ask your admin or check your CrowdStrike portal URL to confirm your region.
:::

# CrowdStrike Setup

Take the following steps to Create API Client :

1. Log into CrowdStrike Falcon console.
2. Navigate to **Support > API Clients and Keys**.
3. Click **Create API Client**.
4. Enter a name and description.
5. Assign required OAuth scopes as per the following list:
   **Core Falcon Permissions -**
   - Detections: Read
   - Detections: Write
   - Hosts: Read
   - Incidents: Read
   - Incidents: Write
   - Real Time Response: Read
   - Real Time Response: Write
   - IOCs: Read
   - IOCs: Write
   - Sensor Download: Read
   - Spotlight Vulnerabilities: Read

         **   Optional (based on actions) -**

:::Paragraph{listStyleType="disc" indent="2"}
RTR Admin commands
:::

:::Paragraph{listStyleType="disc" listStart="2" indent="2"}
Quarantine / Scan management
:::

:::Paragraph{listStyleType="disc" listStart="3" indent="2"}
Sandbox file submission
:::

![](https://api.archbee.com/api/optimize/n8uUzk0MM4uC57-zlHNtY/wwieU3EXwcJPTIRMd3rQh_image.png)

6. Click **Create** and copy:
   - **Client ID**
   - **Client Secret**

:::hint{type="info"}
These values will not be shown again. Store them securely.
:::

Take the following steps to collect Member CID:

:::hint{type="info"}
This is an optional step and is only required if your environment is MSSP (Managed Security Service Provider).
:::

1. Go to **User > My Profile** in CrowdStrike.
2. Locate **Customer ID (CID)**.
3. If multiple tenants exist, use the **member CID** assigned to your sub-org.

![](https://api.archbee.com/api/optimize/n8uUzk0MM4uC57-zlHNtY/rvaYVjRuOyGUmLd1M9OJ-_image.png)

# Connector configuration in Swimlane

1. Log in to Turbine.
2. From the left-hand navigation pane, click **ORCHESTRATION** and click **Assets**.
   Asset homepage opens.
3. Click the **plus** icon to open the Configure your Connector Asset window.
4. Select **CrowdStrike Falcon **from the Asset type list.
5. Fill in the **Asset Settings **and **Asset Input** as shown:

| **Field**      | **Description**                | **Required** |
| -------------- | ------------------------------ | ------------ |
| url            | Base URL for your Falcon cloud | Required     |
| client\_id     | Client ID from CrowdStrike     | Required     |
| client\_secret | Client Secret from CrowdStrike | Required     |
| member\_cid    | Required only for MSSP         | Optional     |
| verify\_ssl    | Enable/Disable SSL validation  | Optional     |
| http\_proxy    | Proxy settings, if applicable  | Optional     |

Fields with \* marks are required.

![](https://api.archbee.com/api/optimize/n8uUzk0MM4uC57-zlHNtY/W1oLVXnIyRz0fBpQjemIJ_image.png)

6. Click **Create**.

# Troubleshooting

### Invalid Credentials Error

- Ensure Client ID / Client Secret were copied correctly.
- Confirm the API client still exists and wasn't regenerated.

### 403 Forbidden

- Missing OAuth scopes.
- Add required permissions and re-authenticate.

### Wrong Region

- Make sure your base URL matches your CrowdStrike cloud.

You have successfully authenticated the Crowdstrike Falcon Connector in Swimlane.