Skip to main content
If your integration signs in through POST /login with a Connector username, password and the X-Api-Key header, follow these steps to switch it to an OAuth 2.0 API credential.
POST /login is deprecated. It keeps working until 31 January 2027. From 1 February 2027, the API accepts integrations only with an API credential, and integrations that still use POST /login can no longer access the API.

​
Timeline

Both methods work at the same time until 31 January 2027, so you can switch one integration at a time without downtime. You do not need to contact Quivo. Switch early. An integration that signs in as a Connector user stops working as soon as that user turns on multi-factor authentication (MFA).

​
What changes

Everything else stays the same: request and response bodies, pagination, webhooks and the error codes of all other endpoints. What changes is the token request and its response, the path prefix and the headers.
All API examples in this guide use ${BASE_URL} as a placeholder. Replace it with the correct base URL configured for the correct environment. For more information see Environments page.

​
Migrate step by step

1

Create an API credential

An Account Admin creates the credential in The Connector under Admin › API Credentials. Copy the client ID and the client secret. The secret is shown only once. Store both in a secrets manager or another secure place. See Create an API credential.Choose the role the integration needs: User, or Account Admin if the integration manages users, seller settings or shop settings.Create one credential per integration. For tests, create a second credential in the sandbox. A credential works only in the environment where you created it.
2

Replace the login call with a token request

Remove the call to POST /login. Request an access token with your client ID and client secret instead.
The response contains the session token in the Token field.
3

Update every API call

Add /v2 to the path, send the access token as a Bearer token, and remove the X-Api-Key header.
4

Update the token handling

Both tokens are valid for one hour. Reuse the access token until it expires. When a call returns 401 Unauthorized, request a new access token and retry the call once.If the token request itself returns 401 with invalid_client, stop retrying and check the credential. See Errors.
5

Test in the sandbox, then switch production

Run your integration against https://api-sandbox.quivo.co with the sandbox credential. When it works, deploy it to production with the production credential.

​
Migration checklist

Your integration is migrated when:
  • It never calls POST /login.
  • Every API call goes to ${BASE_URL}/v2/....
  • No request sends an X-Api-Key header.
  • Every API call sends Authorization: Bearer <YOUR_ACCESS_TOKEN>.

​
Where to go next

Authentication

Token requests, errors, token expiration and rate limits in detail.

Legacy login (deprecated)

The old POST /login method, for reference until it is retired.

Create an API credential

Create, rotate and revoke the credential your integration uses.