API Credentials Guide

Overview

API credentials (a Client ID and Client Secret) allow external systems to authenticate with the tieback platform programmatically. This guide covers how to create, rotate, revoke, and use them.

Creating a credential

1. Navigate to Settings → API Credentials.
2. Click Create Credential.
3. Fill in a descriptive Name (e.g., “ERP Sync — Production”).
4. Set Scopes to the permissions required (e.g., products:read).
5. Optionally add a Metadata tag and an Expiry date.
6. Click Create.

One-time secret rule

After creation, your Client Secret is displayed exactly once in a secure modal:

• Copy both the Client ID and Client Secret using the copy buttons.
• Download as .env or JSON for safe storage.
• Check both acknowledgement boxes to confirm you have stored the secret.
• Once you close the modal, the secret cannot be viewed again.

Copying and downloading credentials

The one-time secret modal provides:

.env format

$
TIEBACK_CLIENT_ID=mk_live_abc123
$
TIEBACK_CLIENT_SECRET=ms_live_xyz789

JSON format

1
{
2
  "TIEBACK_CLIENT_ID": "mk_live_abc123",
3
  "TIEBACK_CLIENT_SECRET": "ms_live_xyz789"
4
}

Editing credential expiry

You can change or remove the expiry date for an active credential, subject to a 72-hour lock window:

To edit expiry:

1. In the credentials table, click Expiry next to the credential.
2. Pick a new date (must be in the future) or clear the field to remove expiry.
3. Optionally enter a Reason.
4. Click Save Expiry.

Rotating a credential

Rotation replaces the secret without changing the Client ID:

1. In the credentials table, click Rotate next to the active credential.
2. Optionally enter a Reason (e.g., “Scheduled quarterly rotation”).
3. Click Rotate Secret.
4. A new one-time secret modal appears — copy and store the new secret immediately.
5. The old secret stops working immediately. There is no grace period.

Revoking a credential

Revocation is permanent and cannot be undone.

You may revoke a credential even if it has expired. Revocation creates an explicit administrative audit record, distinct from time-based expiry. The UI will display “Revoked” even if the expiry date is in the past.

1. Click Revoke next to the credential.
2. Enter a reason.
3. Click Revoke.
4. The credential is marked as revoked and can no longer authenticate.

If you need access again, create a new credential.

Using credentials in API calls

Use supabase.functions.invoke to call tieback API endpoints. The SDK automatically attaches the required headers.

1
import { createClient } from '@supabase/supabase-js';
2
3
const supabase = createClient(SUPABASE_URL, SUPABASE_ANON_KEY);
4
5
// Example: list products
6
const { data, error } = await supabase.functions.invoke('api-credentials/list', {
7
  body: { brand_id: 'your-brand-id' },
8
});

Finding your Brand ID

Your Brand ID is shown on the Settings → Brand Settings page as a read-only field. Click the copy icon to copy it to your clipboard.

Security best practices

• Never commit secrets to git. Add .env to your .gitignore.
• Use a secrets vault (e.g., 1Password, AWS Secrets Manager, Doppler) for production credentials.
• Rotate regularly — at least quarterly for production credentials.
• Use least-privilege scopes — only request the permissions your integration needs.
• Revoke immediately if a secret is compromised or no longer needed.
• One credential per integration — don’t share credentials across systems.

FAQ

Can I see the secret after closing the modal? No. The secret is shown only once. If lost, rotate to generate a new one.

Can I reactivate a revoked credential? No. Revocation is permanent. Create a new credential instead.

What happens when a credential expires? Expired credentials are treated as inactive and can no longer authenticate. Create a new one or remove the expiry before it lapses.