The job of this console
Issue least privilege, give it to the caller, rotate, revoke when the project ends. Prove calls on the Integration API console.
Integrations · API
API Access
Tokens and scopes for external callers of Tracopus APIs — not Admin API keys for in-product apps, and not a connector password.
Scroll to Flowcharts. Scenario: Issue an integration API token with least privilege.
Inbound tokens
How an external system is allowed in
API access issues scoped tokens for callers of Tracopus APIs. It is not the Admin key vault and not a Salesforce password.
Integrations → API access
Route
/integrations/api-access
Org flag apiAccessEnabled
Integration admin · Admin
Seat at the table
Integration admins and admins with apiAccessEnabled. Tokens inherit RBAC — they are not god keys.
The working rhythm
Create, prove, hand off, rotate, revoke.
Moments that bring you here
A new middleware. External project create. Replacing a shared user login. After a leak.
ⓘ
Three secret places
This page: inbound API. Connections: vendor outbound. Admin API keys: in-product apps. Never mix them.
Flowcharts
1 — Scope then issue
Create a least-privilege token for an external caller.
flowchart TD
A[Open API access] --> B[Create token]
B --> C[Scopes]
C --> D[Caller uses token]
D --> E[Rotate]
- 1OpenIntegrations → API access.
- 2ScopeLeast privilege.
- 3IssueTo the caller.
- 4RotateOn expiry.
Overview
API access issues integration tokens for external systems calling Tracopus. Admin API keys are for platform apps on the developer portal. Connector credentials live on Connections. Application Config is not a token vault.
How to use
1. Document the owner
Orphan tokens linger.
2. Same RBAC
A token cannot see what the principal cannot.
3. Interactive explorer
Integration API console for proving calls.