Integrations

Create API users for the marketplace API, manage secrets, and obtain connection details and sample requests.

The Integrations screen (page title Integration users) is where you manage API users for external systems connecting to the marketplace API (ERP, integrator software, etc.). Here you generate API keys and secrets, copy the connection URL and your vendor number, access API documentation, and get ready-made sample requests in four programming languages. The screen operates on behalf of the vendor ID linked to your account; it is intended for the software or operations team setting up the integration.

Accessing the screen

Follow the menu path Settings & Authorization › System › Integrations. If you do not see it in the menu, your account does not have permission for this screen.

The New API user, Reveal secret, and Delete API user buttons appear only on accounts with integration user management permissions. If you do not see them, you can only view the information.

Screen sections

Below the page title is the description "Your API users, connection details, and sample requests to connect to the marketplace API." Four sections follow:

1. Connection details: API base URL, vendor number, authentication method, and first steps.
2. Documentation: Links to API documentation.
3. API users (…/…): List of created API users and management buttons.
4. Sample requests: Copyable code examples.

If your account is not linked to a vendor ID, an information card appears instead of these sections (see Common scenarios).

Connection details

Below the card, the steps provide a brief integration summary:

1. Create a user with "Create API user" (up to 5).
2. Add Basic key:secret (Base64) to the Authorization header in requests.
3. Copy the examples below and try them in Postman or your code.

A Copied notification appears upon successful copying.

Documentation

Below the note "All endpoints, fields, and error codes are in the API documentation." are these buttons, each opening in a new tab:

• Turkish document and English document: Visible if a document file is defined for your setup.
• docs.hebiar.com: General API documentation site.

API users

The section title shows the number of active users and the maximum allowed (e.g., API users (2/5)). Below is the note: "It is recommended to create a separate user for each integration (ERP, integrator); if one is compromised, you only delete that one."

Each row shows:

If no users exist yet, it shows "You have no API users yet" and "Create a new API user to start integration."

Actions

Creating a new API user

1. Click the New API user button in the API users section.
2. Read the confirmation box: "A new API key and secret will be generated. Up to 5 users can be created. The secret is shown only once."
3. Click Create.
4. The API user created box shows the new API key and API secret. Copy each with the Copy icon and save securely. The box warns: "Save the secret securely now. Do not share it via email or message."
5. Click I saved it to close the box. The list refreshes.

If the server does not return the secret at this step, the box does not open; instead, a notification says "API user created; you can view the secret from the list."

If five users are created, the button is disabled; hovering shows "Up to 5 API users can be created; delete one to add a new one." If creation fails, the confirmation box remains open and shows the error inside; during processing, the Create button shows Saving….

Revealing and hiding the secret

1. Click the eye icon (Reveal secret) next to the API secret in the relevant row.
2. The full secret value appears with a Copy icon.
3. Click the Hide icon in the same place to conceal it again.

Secrets left visible automatically hide after about 60 seconds; a note appears below the list: "Displayed secrets will be hidden automatically after 60 seconds." If multiple secrets are revealed, the timer starts from the last opened and all hide together. If the secret cannot be retrieved, an error notification appears.

Deleting an API user

Delete a key if it is no longer used or suspected compromised.

1. Click the trash can icon (Delete API user) on the right of the row.
2. Read the confirmation warning: "… will be deleted. Integrations using this key will stop immediately."
3. Click Delete.

If successful, an API user deleted notification appears and the list refreshes. Deletion is irreversible; to continue the same integration, create a new user and update the integration with the new key. If deletion fails, the error is shown in the confirmation box.

Sample requests

"Copy to Postman or your code. By default, placeholders are used."

Sample code contains placeholders like {BASE_URL}, {SUPPLIER_ID}, {BATCH_ID}, and Basic {BASE64(API_KEY:API_SECRET)} by default. If the API base URL is defined and the selected API user has a supplier id, these two are inserted with real values without checking the box; only the credentials (Authorization header) are filled by the box below. Copy the code with the Copy button at the top right.

Filling the example with real credentials

1. First, in the API users section, reveal the secret of the API key selected in the example using Reveal secret.
2. In the Sample requests section, check the Fill with my real credentials box.
3. The Authorization header in the example is filled with the real key and secret; a warning Sample contains live credentials appears.

If the secret is not revealed, the box is disabled and shows "Reveal the secret first to fill with real credentials." When the secret auto-hides, the example returns to placeholders.

Do not paste examples containing real credentials into shared places such as email, chat, or support tickets.

Common scenarios

• "This account is not linked to a vendor" message appears. API users are created linked to a vendor ID. Your session lacks a vendor ID, so the list is empty and you cannot create new users. Only authentication info, first steps, and (if defined) documentation buttons appear. Contact your system administrator to link your account to a vendor.
• New API user button is disabled. You have reached the limit of five users. Delete an unused user and try again.
• I forgot to save the secret. You can view it again with Reveal secret. If you do not see this button, ask a user with permission for help.
• Integration suddenly stopped working. The API user it used may have been deleted. Check if the key is still in the list; if not, create a new user and update the integration.
• API base URL is not visible. If it says "API base URL is not defined for this setup; please request from support," the URL is not yet defined for your setup; contact support.
• "Something went wrong" appears on screen. Data failed to load. Click Retry; if the problem persists, send the text in the Technical detail section to your system administrator.

Related screens

• Integration (Vendor panel)
• API clients
• Cache
• Store settings