Skip to main content
Your integration uses an API credential to get access tokens. You create, rotate and revoke credentials in The Connector web app. If you already have a credential, go to Make your first API call.

​
Prerequisites

Before you start, make sure you have:
  • Connector Web App access: A Connector account with the Account Admin role for your seller.

​
Who can create a credential

Account Admins create, rotate and revoke credentials for their sellers. No approval from Quivo is needed. Each seller can have up to 4 active credentials. If you already have 4, revoke one before you create another. Use one credential per integration. Then you can rotate or revoke each one on its own.

​
Create a credential

  1. Sign in to The Connector Web App.
  2. In the left sidebar, under Admin, open API Credentials (/admin/api-credentials).
  3. Click New Credential.
  4. Enter a name that tells you later which integration uses the credential, for example Shopify sync.
  5. Choose a role: User, or Account Admin if the integration manages users, seller settings or shop settings. If you manage more than one seller, also choose the seller. Then click Create credential.
  6. Copy the Client ID and the Client secret, and store them securely.
The client ID starts with qak_, followed by 24 characters.
The client secret is shown only once, when you create or rotate a credential. It cannot be displayed again. If you lose it, rotate the credential to get a new one.
An API credential replaces the static API key. You do not need an X-Api-Key header.

​
Rotate a credential

Rotate a credential before it expires, or to replace its secret on a regular schedule. In the credential’s row menu, click Rotate.
  • Rotating creates a new credential with a new client ID and client secret.
  • The old credential keeps working for up to 7 days, so your integration can switch to the new one. Then it is revoked automatically.
  • You can revoke the old credential earlier, once your integration uses the new one.
If a client secret may be exposed, do not wait the 7 days. Rotate the credential, update your integration with the new client ID and client secret, and then revoke the old credential right away.

​
Revoke a credential

In the credential’s row menu, click Revoke. A revoked credential can no longer get access tokens.

​
Expiry

Credentials expire one year after they are created. The Connector sends you a message 90, 30, 7 and 1 days before a credential expires. At 30 days, your users also get a notification in The Connector. When the credential expires, it is revoked and a final message is sent. To avoid an outage, rotate the credential before it expires and update your integration. A credential that was already replaced by a rotation gets no expiry warnings.
Each environment has its own credentials. A credential created in the sandbox web app works only with the sandbox API. See Environments.

​
Where to go next

Make your first API call

Get an access token and make your first authenticated request.

Authentication

Token requests, errors, token expiration and rate limits in detail.