Rotate supplier credentials without recreating the connection

On a connection you already have, you can replace an expired API key or a changed feed address in place. Open the connection, scroll to the Credentials section, update what changed, and save. There is no need to delete the connection and build it again.

What the Credentials section is for

The section states its own scope: "Rotate this supplier's auth secrets or base URL without recreating the connection. Leave a secret field blank to keep its current value."

Two details sit at the top as read-only text. Auth type shows the method this connection was created with (for example Bearer token or API key in the query string), and it cannot be changed here. Rotation changes credential values, never the authentication method. Base URL is shown there as well, but it appears again below as an editable field, and that lower field is the one that saves.

Below those is a Secret status: line with a badge for each secret the connection holds, so you can see at a glance whether a value is stored. Depending on the auth type the badge reads, for example, Token set or Token not set, Password set, Client secret set, or the credential's own name followed by "set" or "not set". A connection with no authentication badges Not applicable and the form says "This connection has no auth secrets to rotate."

The editable fields also follow the auth type: an API key header shows API key header name and API key; a bearer connection shows Bearer token; basic auth shows Username and Password; OAuth2 shows Token URL, Client ID and Client secret; a login exchange shows Login URL plus one field per stored credential; an API key in the query string shows one field per stored parameter. You can change the value of a credential, but you cannot add one or rename it.

Rotate a secret

1. Go to Connections and open the connection.
2. Scroll to Credentials.
3. Enter the new value in the relevant field. Leave every secret you are not changing blank, because blank means keep the stored value. Secret fields you have already set show the placeholder "Leave blank to keep current".
4. Edit Base URL only if the supplier moved the feed. Clearing it keeps the current one rather than emptying it.
5. Click Test connection. The test uses the values currently typed into the form, including ones you have not saved yet, and it writes nothing to your store.
6. If the test passes, click Save credentials.

Test first, then save. Saving does not run a test, and testing does not save. Saving also marks the connection active.

The four result banners

One banner above the form reports the outcome, and its heading names which action ran.

Connection test passed means the supplier answered with your new values. The body says how many sample records came back, or that the supplier answered but returned no records, which tells you the credentials work even though the feed was empty at that moment. That count is a sample of up to three records from the first page, not the size of the feed.

Connection test failed carries the supplier's own reason, or "This supplier did not say why" when it gives none, followed by "Check the base URL and credentials, then test again."

Credentials saved confirms the write. Its body asks you to test the connection to confirm the new values work, which is worth doing if you saved without testing. A "Credentials saved" toast appears as well.

Couldn’t save credentials means the save did not go through, and the body names the reason.

Why not delete and recreate

Rotating keeps everything else about the connection: its field mapping, sync scope, ignore list, schedule and sync history all stay as they are. Deleting removes the connection itself. The delete confirmation says it removes the connection, its credentials and its schedule, and that the action cannot be undone, with a warning that "Scheduled syncs for this supplier stop immediately". A rebuilt connection has to be mapped and scheduled from scratch, so use Credentials instead.

Supplier credentials are encrypted at rest, and support will never ask you for an API key or token by email. Do not send one.

Need help? Visit the support page or email hello@usenormalize.com.