Rotate supplier credentials without recreating the connection

Account and securityUpdated 6 October 2026

On a connection you already have, you can replace an expired API key or a changed feed address in place. Open the connection, scroll to the Credentials section, update what changed, and save. There is no need to delete the connection and build it again.

This works for every kind of connection:

  • REST API feed: the base URL and the auth secrets, described below.
  • WooCommerce store: the Store URL, Consumer key and Consumer secret.
  • CSV or spreadsheet file at a web address: the File URL.
  • FTP, FTPS or SFTP: the Host, Port, File path, Username, and the Password, or the Private key and Key passphrase.
  • Uploaded file: upload a new file from Credentials at any time.

For WooCommerce, CSV and FTP connections, new details are tested when you save, and nothing is saved if the test fails, so a mistyped key can never replace one that works. The kind of source cannot change here: to move from a link to FTP, for example, connect the supplier again.

What the Credentials section is for

The section states its own scope: "Rotate this supplier's auth secrets or base URL without recreating the connection. Leave a secret field blank to keep its current value."

One line sits at the top as read-only text. It shows the method this connection was created with (for example Bearer token or API key in the query string) and whether each secret is set, and the method cannot be changed here. Rotation changes credential values, never the authentication method. Base URL is the editable field below it.

Below those is a Secret status: line with a badge for each secret the connection holds, so you can see at a glance whether a value is stored. Depending on the auth type the badge reads, for example, Token set or Token not set, Password set, Client secret set, or the credential's own name followed by "set" or "not set". A connection with no authentication badges Not applicable and the form says "This connection has no auth secrets to rotate."

The editable fields also follow the auth type: an API key header shows API key header name and API key; a bearer connection shows Bearer token; basic auth shows Username and Password; OAuth2 shows Token URL, Client ID and Client secret; a login exchange shows Login URL plus one field per stored credential; an API key in the query string shows one field per stored parameter. You can change the value of a credential, but you cannot add one or rename it.

Rotate a secret

  1. Go to Connections and open the connection.
  2. Scroll to Credentials.
  3. Enter the new value in the relevant field. Leave every secret you are not changing blank, because blank means keep the stored value. Secret fields you have already set show help text under the field, such as "Leave blank to keep the current API key."
  4. Edit Base URL only if the supplier moved the feed. Clearing it keeps the current one rather than emptying it.
  5. Click Test connection. The test uses the values currently typed into the form, including ones you have not saved yet, and it writes nothing to your store.
  6. If the test passes, save it through the Shopify admin save bar, which appears at the top of the screen once you have changed something.

Test first, then save. For a REST API feed, saving does not run a test, and testing does not save. For WooCommerce, CSV and FTP connections, saving runs the test for you and stores the new details only if it passes. Saving also marks the connection active.

The four result banners

One banner above the form reports the outcome, and its heading names which action ran.

Connection test passed means the supplier answered with your new values. The body says how many sample records came back, or that the supplier answered but returned no records, which tells you the credentials work even though the feed was empty at that moment. That count is a sample of up to three records from the first page, not the size of the feed.

Connection test failed carries the supplier's own reason, or "This supplier did not say why" when it gives none, followed by "Check the base URL and credentials, then test again."

Credentials saved confirms the write. Its body asks you to test the connection to confirm the new values work, which is worth doing if you saved without testing. A "Credentials saved" toast appears as well.

Couldn’t save credentials means the save did not go through, and the body names the reason.

Why not delete and recreate

Rotating keeps everything else about the connection: its field mapping, sync scope, ignore list, schedule and sync history all stay as they are. Deleting removes the connection itself. The delete confirmation says it removes the connection, its credentials and its schedule, and that the action cannot be undone, with a warning that "Scheduled syncs for this supplier stop immediately". A rebuilt connection has to be mapped and scheduled from scratch, so use Credentials instead.

Supplier credentials are encrypted at rest, and support will never ask you for an API key or token by email. Do not send one.

Need help? Visit the support page or email hello@usenormalize.com.