Skip to main content

How to Generate API Tokens and Secrets

Create secure credentials for integrating with external systems like Zapier, Make, or custom APIs.

Updated over a month ago

To integrate this system with other applications or services using its API (Application Programming Interface), including third-party tools like Zapier or Make, you need to generate a unique API Token (Client ID) and a corresponding Client Secret.

Steps to Generate Credentials:

  1. Navigate to Settings: Access the main Settings area of the system.

  2. Open Security: Within Settings, select the Security section.

  3. Find API Tokens: Locate and click on the API Tokens subsection.

  4. Generate New Token: Click the button labelled Generate New Token (or similar).

  5. Name Your Token: Provide a descriptive Token Name so you can easily identify its purpose later (e.g., "Zapier Integration", "Mobile App Access", "Data Warehouse Sync").

  6. Set Expiry Date (Optional but Recommended):

    • You can set an Expiry Date for the token.

    • This is a security measure ensuring the token automatically becomes invalid after the specified date, preventing indefinite access. It's highly recommended, especially for temporary or specific tasks.

    • If you don't set a date, the token will remain active until manually revoked.

  7. Generate: Click the Generate button to create the credentials.

  8. CRITICAL: Copy and Store Your Client Secret:

    • The system will now display a unique Client Secret.

    • This secret is shown ONLY ONCE. You must copy it immediately.

    • Store this secret securely (e.g., in a password manager or secure vault). It cannot be retrieved again later.

    • You will need both the Client ID (generated in the next step) and this Client Secret to authenticate your API connection.

  9. Confirm: After you have securely copied and stored the Client Secret, click Done.

  10. Review Your Token: Your newly generated token will now appear in the API Tokens list. You will see:

    • Client ID: This is the unique identifier for your token (often used as the API key/token).

    • Token Name: The name you provided.

    • Expiry Date: The date you set (if any).

    • (Note: The Client Secret is NOT displayed here for security reasons).

Security Best Practices:

  • Guard Your Secret: The Client Secret acts like a password for your API access via this token. Keep it confidential. Do not share it publicly, commit it to code repositories, or store it insecurely.

  • Use Expiry Dates: Limit the lifespan of tokens, especially for testing or specific projects.

  • One Token Per Integration: Generate distinct tokens for different applications or services. This allows you to revoke access for one service without affecting others if needed.

Usage:

Use the generated Client ID and the securely stored Client Secret when prompted by external applications (like Zapier, Make) or when making direct calls to the system's API.

Did this answer your question?