API clients

Create API clients for integrations, obtain the secret key, narrow permissions, rotate the key, or revoke the client.

The API clients screen is where you register clients so that external systems (integrations) can connect to the platform with their own identity instead of a person's username and password. Each client has a client_id value, a secret key, and a role; the integration can only perform the actions permitted by this role. This screen is typically used by system administrators who set up and maintain integrations.

As stated in the subtitle of the screen: The key is not verified on every request: it is converted once into a short-lived token. This means the integration uses the secret key only when logging in; actual requests are made with a short-lived valid access key.

Accessing the screen

Follow the menu path Settings & Authorization › Access › API clients. If you do not see it in the menu, your account does not have permission for this screen.

Screen sections

From top to bottom, the screen consists of the following parts:

Title — API clients and a description line.
Secret key box — Visible only when you create a new client or perform rotation on a client, shown inside a yellow box (see below).
Narrow permissions panel — Opens when you press the Narrow permissions button on a row.
New client form — Fields for First name and Role with the Create button.
Client list — All defined clients, including revoked ones.
Footnote — Old key works for 24 more hours; the client closes automatically after that.

There is no filter or search field on this screen; the list shows all clients on a single page.

List

Column	Meaning
First name	The name you gave the client. Status badges appear below: revoked (red) indicates the client is no longer usable, rotation window open (yellow) indicates a new key has been generated and the old key is still valid during the 24-hour transition period.
client_id	The identity the integration uses to identify itself. Below it, a short hint is shown instead of the full secret key; you can compare this to see which key is used in the integration.
Roles	Badges showing the codes of the roles the client has. The line below summarizes the permission scope: whole role (no narrowing) or for example narrowed to 5 permissions.
Last used	The last time the client was used (date and time). If never used, it shows never.

At the end of each row, there are three buttons: Narrow permissions, Rotate, and Cancel. All three buttons are disabled for revoked clients.

If the list is empty, the message No API clients and the hint Create a narrowly scoped client for each integration. appear.

Actions

Creating a new client

Use this when setting up a new integration or when you want to assign a separate identity to an existing integration.

Enter a name in the First name field that describes what the client will be used for (e.g., "Marketplace order transfer"). This name is for your recognition only.
Select the client's role from the Role list. Options are in the format "Role name — role code." Choose the narrowest role that fits the integration's needs.
Press the Create button. The button is disabled until both the name and role are selected.

Result: The client is added to the list, the First name field is cleared (the selected Role remains selected), and a yellow secret key box opens at the top of the screen: The secret is shown only once. Copy it now:

The Copy button copies the key to the clipboard and shows the Copied. notification.
The Cancel button closes the box.

The secret key is visible only at this moment; the system stores it in unreadable form and cannot show it again later. Save the key securely (in the integration settings or your password manager) before closing the box or leaving the page. If you lose the key, the only solution is to generate a new one via Rotate.

You must provide the integration with the client_id value (visible in the list) and this secret key together.

The box shows only one key at a time. If you create another client or perform Rotate on a client while the box is open, the key in the box is replaced by the new one and the previous key is no longer shown. Copy each key before proceeding to the next operation.

Narrowing permissions

Use this to reduce the permissions of a client if its role contains more permissions than needed, without changing the role.

Press the Narrow permissions button on the relevant row.
A panel opens at the top of the list; it shows the client's name and client_id value at the top. Below is the explanation: Which permissions from the role can be used. If none are checked, the whole role is valid; permissions cannot be ADDED here, only narrowed.
The list shows only the permissions carried by the client's role (with permission codes). Check the permissions you want the client to be able to use.
Press Save. To cancel, press Cancel.

Result: The Saved. notification appears, the panel closes, and the line under the Roles column in the list updates (narrowed to {number} permissions or whole role).

Notes:

If you uncheck all permissions and save, the narrowing is removed and the client uses the whole role. You cannot create a "no permissions" state this way; to completely stop the client, use Cancel.
You cannot add permissions not in the role from this panel. If the client needs more permissions, you must expand its role (see the Roles screen).

Rotation (renewing the key)

Use this when the secret key is lost, suspected to be leaked, or for regular key changes.

Press the Rotate button on the relevant row. No confirmation is asked.
A yellow box opens at the top showing the new secret key. Copy it with Copy and update the integration settings.

Result: The rotation window open badge appears on the row. The old key remains valid for 24 more hours; when the integration switches to the new key, the old key closes automatically. This allows you to change the key without interrupting the integration.

If the key was leaked and 24 hours of old key validity is unacceptable, rotation is not enough: revoke the client with Cancel and create a new client.

Revoking a client

Use this when the integration is no longer used or the client's access must be immediately cut off.

Press the Cancel button on the relevant row.
Confirm the browser prompt Revoke this client? This cannot be undone.

Result: The revoked notification appears, a red revoked badge is shown on the row, and all buttons on the row become inactive. Revocation cannot be undone; to reconnect the same integration, you must create a new client. Revoked clients remain in the list.

Statuses

Status (text on screen)	Meaning	Next step
No badge	Client is active with a single valid key.	—
rotation window open	A new key has been generated; the old key is still valid during the 24-hour transition period.	Switch the integration to the new key.
revoked	Client is permanently closed; no keys work.	Create a new client if needed.

Common situations

Create button is not clickable. You must fill in the First name field and select a Role.
I closed the box without copying the secret key. The key cannot be shown again. Perform Rotate on the row and copy the new key; the old key works for 24 more hours so the integration is not interrupted during this time.
The permission I am looking for is not in the narrow permissions panel. The panel only lists permissions in the client's role. For missing permissions, the client needs a broader role.
I unchecked all permissions but the client can still do everything. If no permissions are checked, the whole role is valid. Use Cancel to cut access.
I received a "Something went wrong" notification during an operation. The operation was rejected by the server (e.g., you lack permission or the service is unreachable); check the notification details and try again.

Related screens

Roles — To view and edit the permissions of roles assigned to clients.
Users — For console access of human users.
Integrations — For API users used by integrations and example requests.