Give a connected system only the API permissions it needs and safely store its one-time credential.
Published 23 Oct 2026 · Updated 25 Oct 2026 · By Moveka
This guide applies when you have Account Edit access and the API service is already enabled for this business. Open Menu, choose Accounts, open the business and choose Integrations.
Practice example: review API clients, webhook subscriptions and current delivery attention for this business.
Choose Create API client. Enter a Client name that identifies the system receiving the credential.
Under Permissions, choose only what that system needs: Read inventory, Read stations, Read reports or Manage webhooks. These permissions allow the named API actions; leave unrelated permissions unselected.
Complete the security check and choose Create client. If the security check is refused, review the message, enter a fresh proof and submit again; the name and selected permissions remain available for correction.
The credential appears on a one-time page. Store it in the connected system’s secure settings now, then choose I saved it. Check the client is listed as Active under API clients.
Practice example: blank API client form showing the name, permission and security-check controls; no credential is created or displayed.
The secret is shown once and cannot be retrieved again. If you did not save it, return to Integrations, open Details for that client, choose Revoke, complete the security check and create a replacement client. Confirm the new client is Active before updating the connected system. Revoking disables the old credential.
A name removed does not make an order anonymous. Use this practical strip-first checklist to protect customer details before using AI for research or drafting.