Manage and Rotate API Credentials in Repsly

Repsly allows administrators to create, manage, and revoke multiple dedicated API credentials for external integrations, tools, and partner systems. Instead of sharing a single, long-lived API key across multiple services, you can assign individual named credentials with tailored permission levels and rotate keys safely with zero downtime.

• Access Requirement: You must have the Application settings permission enabled in Repsly Web.

• Location: Navigate to Application Settings and then select API Credentials.

• Multiple Active Credentials: You can have up to 10 active API credentials per account at any time.

• One-Time Secret Reveal: For security, secret keys are displayed only once upon creation. Store your secret key securely immediately after generating it.

• Legacy API Key: Your existing API key has been automatically migrated and labeled as Legacy to ensure continuous integration uptime.

  

• Permission Types:

  • Read & Write: Full access to read and submit data via the API.

  • Read Only: Allows reading data without permissions to modify or submit records.

  • Write Only: Allows pushing/submitting data without retrieval permissions.

1. Go to Application Settings and select API Credentials.

   

2. You can access API documentation on this step. 

   

   

3. Click New credential in the top right corner.

   

4. Enter a descriptive Credential Name / Label (e.g., PowerBI Data Pipeline, Shopify Sync, Partner Implementation).

   

    

5. Select the Permission Type:

   • Read & Write

   • Read Only

   • Write Only

     

6. Click Save credentials.

7. On the Credential created confirmation screen, click Copy password and store it in a secure password manager or secrets vault.

   

   ⚠️ Important: Once you close this window, the secret key (password) cannot be retrieved or viewed again.

Revoking an API credential permanently disables it. Any external application using a revoked key will immediately receive a 401 Unauthorized response.

1. In the API Credentials list, click on the credential you wish to disable.

   

2. Review the credential details and click Revoke credential.

   

    

3. In the confirmation dialog, type/confirm the credential name and select Revoke.

   

4. The credential status will update to Revoked. Revoked credentials remain visible for historical reference and cannot be reactivated or deleted.

   

• By default, the API Credentials page displays active credentials.

• Check the Show inactive credentials box at the top of the table to view past, revoked keys and their creation/revocation history.

  

• When contacting Repsly Support for troubleshooting, provide the Credential ID (visible in credential details), never the secret key.

Q: What happens to our existing API key?
Your existing key continues to work as before and appears in your credentials list with the label Legacy.

Q: Can I retrieve a lost secret key?
No. For security reasons, secret keys are never stored in plain text and cannot be re-displayed. If you lose a secret key, create a new credential and revoke the old one.

Q: What should I do if I reach the 10-credential limit?
Review your credentials list, locate unused or obsolete credentials, and revoke them to free up capacity for new ones.

Q: Can I assign permissions to specific forms or custom fields?
Not at this time. Current permissions apply at the account level (Read & Write, Read Only, or Write Only).