Skip to main content

API Credentials

API credentials let you authenticate programmatic access to the Shoplogix IMS platform. Each credential consists of a client ID and a client secret that you exchange for a Bearer token to make API calls.

Who Can Manage Credentials​

The Developer role is required to create, rotate, and delete API credentials.

Creating a Credential​

  1. In Shoplogix IMS, navigate to API Credentials
  2. Select Create Credential
  3. Fill in the credential details:
FieldRequiredNotes
NameYesA label to identify this credential (e.g., "SCADA Integration", "Staging Pipeline")
Customer scopeYesWhich customer account this credential can access
Privilege levelYesThe permission level this credential acts with (read-only, user, admin, etc.)
Expiration dateNoOptional end date after which the credential stops working; leave blank for a non-expiring credential
  1. Save — the client secret is shown once at this point. Copy it immediately; it cannot be retrieved again.

Viewing and Copying the Secret​

The client secret is only displayed at the moment of creation. Use the clipboard button to copy it before closing the dialog. If you lose the secret, you must rotate the credential to generate a new one.

Rotating a Credential​

To generate a new secret without changing the client ID:

  1. Find the credential in API Credentials
  2. Select Rotate Secret
  3. The new secret is shown once — copy it immediately
  4. Update any integrations using the old secret before it is invalidated

Deleting a Credential​

To permanently revoke a credential:

  1. Find the credential in API Credentials
  2. Select Delete
  3. Confirm the deletion

Any application using the deleted credential will receive 401 Unauthorized responses. There is no grace period.

Using Credentials to Get a Token​

Exchange your client ID and secret for an OAuth 2.0 Bearer token using the Auth0 client credentials flow. Once you have a token, include it in every API request:

Authorization: Bearer <token>

See REST API Authentication for the full token exchange flow.

Best Practices​

  • One credential per integration — use separate credentials for each system or service so you can rotate or revoke them independently
  • Minimum privilege — assign the lowest privilege level the integration actually needs
  • Set an expiration date for temporary integrations or testing credentials
  • Rotate regularly — even non-expiring credentials should be rotated periodically as a security hygiene measure