An integration signs in with credentials that carry a role, and the role decides which API actions it may call.
- Create a role
Settings › API › API roles. Name it after the integration ("accounting-export"), and grant only the actions it calls.
- Issue the credential
Link it to the administrator it acts as and to the role, describe which system uses it, and save.
- Copy the secret now
It is shown once.
- Restrict where it works
Limit it to the addresses your integration calls from.
- Test it
Call one harmless read action and check the result field; then call an action the role does not grant and confirm it is refused.
Never put the secret in a URL
Query strings end up in server logs and browser history. Send credentials in the request body or headers.
Rotate by issuing a second credential and moving the integration onto it before deleting the first. Revoke at once when someone leaves or a secret may have been exposed.
Full guide
The complete reference is Create API credentials in the WBAMS documentation.