Give every integration its own access—and its own off switch
Name the connected system before it receives a secret
Create ERP bridge · production as its own MEMBER credential instead of borrowing a human login. The API Key Name and description tell operators exactly which consumer depends on it, while MEMBER starts without broad implicit access.
Cybership reveals the generated token in the dedicated creation dialog. Move it directly into the consumer's secret store; settings screens keep the credential record, not a reusable copy of the token.
Create API Key
One credential identity for one connected system
API Key Name
Description
Power Role
Credential record
Created by Jack K. · Apr 30, 2026 · 09:30
No shared human password
The ERP gets a named team credential instead of borrowing a user session.
Access immediately after create
0 custom permissions
This member key receives permissions only when custom roles are assigned in the next step.
Creation-time handoff
The token appears in the next dialog so it can move directly into the connected system's secret store.
API Key Created
Your API key has been created successfully. Copy it now because it will not appear in the settings list.
API Key
cyb_[stored-in-secret-manager]_[redacted]Replace one connection without breaking the others
Use a deliberate manual runbook: create v2, assign Catalog Reader and Order Intake separately, update and verify the ERP with its new token, then disable v1. The new key stays Active while requests made with the disabled key are rejected.
Request metrics retain the key name and ID. Supported inventory and return actor records retain the API-key ID, giving teams a bounded machine identity without logging the token itself.
Manual replacement runbook
Create v2 → assign roles → update and verify the ERP → disable v1
- 01v2 active
Create v2
Create a new MEMBER key and store its creation-time token.
- 022 roles
Assign its roles
Add Catalog Reader and Order Intake to v2 in Manage Roles.
- 03GET 200
Update and verify the ERP
Update the ERP secret and confirm an authenticated product read.
- 04v1 → 401
Disable the old key
Turn off v1 after the ERP succeeds with v2; requests using the old token are rejected.
ERP bridge · production · v2
ak_erp_bridge_v2
Replacement credential now used by Northline ERP
ERP bridge · production
ak_erp_bridge_v1
Sync catalog and order data with Northline ERP
Old credential request
GET /shipos/products
ERP bridge · production · v1 is Disabled, so its token can no longer authenticate.
Request attribution
ERP bridge · production · v2
Request metrics retain the key name and ID. Supported inventory and return actor records retain the API-key ID; the token does not travel with either.
Give every integration a smaller blast radius and a bounded caller identity
Replace shared human access with named credentials whose permission union, request limits, and lifecycle state travel through the API path. Request metrics retain the key name and ID; supported operational records retain the key ID.
- moves the generated token out of the settings flow
- 1 revealthe named credential remains visible afterward, while list and detail screens do not reproduce the secret
- assigned roles become an exact permission union
- 2 → 3Catalog Reader and Order Intake supply three distinct grants while Product writes remain outside the key
- keeps both sides of a manual cutover visible
- Active / Disabledv2 remains active after verification while v1 is disabled without interrupting unrelated keys
- applies the shown request window to this key
- 30 / 60slimit, remaining, and reset headers let the ERP pace its own calls without sharing another credential's allowance
Trusted by 3PLs and brands
See it in your operation
Bring us the integration access your team is afraid to disable
Show us the systems, shared credentials, required endpoints, and hand-built replacement process in your operation. We’ll map each connection to a named key, role union, request boundary, and manual cutover.
No sales call is required to get sandbox access.
Continue exploring
Related workflows
Audit Logs
Platform
Investigate operational changes beside the order, inventory movement, return, delivery, rule, or file job that produced them.
Access Controls
Access
Build custom permission roles, invite scoped members, and gate warehouse work by job and location.
Integrations
Integrations
Carry provider-specific connections through visible sync state and into the warehouse work that uses them.
Webhooks
Integrations
Send scoped operational events, inspect every attempt, retry failures, recover endpoints, and rotate signing secrets.