Account security and API access
Protect operator accounts and review API key scopes without exposing credentials.
Every operator should have a separate sign-in. Administrators maintain organization permissions while teammates working in the inbox receive access appropriate to customer support. Before configuring another integration, review both the team's roles and each account's personal security settings.
Protect your operator profile
Open Profile → Security to review authentication settings, including two-factor authentication where available. Operators manage their own personal sign-in settings. Administrators set organization roles under Team.
Review API keys and scopes
Under Settings → API Keys, an administrator can inspect existing credentials and revoke access. Choose Generate New Key to create one, name its purpose, select the sites and limit its permissions to the tasks the integration actually needs. Keep the secret in a credential vault, never in a screenshot or repository. Revoke the key when it is no longer needed.
Scope each credential to the right sites
The form separates Site access from permission Scopes. Choosing All current and future sites would also give the integration access to storefronts created later. For TopSoft4U reporting, choose Selected sites and only the permissions necessary to read the intended data.
Convor shows the generated secret after creation. Store it immediately. If the server returns without a usable value, inspect the credential list before making another create request. An additional retry could leave two active credentials. A name alone cannot authorize operations. At least one scope must be selected.
Rotate keys when an integration changes
Name credentials after their actual consumer, such as TopSoft4U reporting, and bind them to the necessary sites. Give separate applications separate keys so you can revoke one without interrupting every integration. To rotate access, create a new key, update the server using it, verify the next request and revoke the older credential. Never embed private credentials in browser code or URLs.
For programmatic operations, start with the REST API reference. Each method, such as POST Invite an operator, documents its required access. The widget's public installation key serves a different purpose. See Widget setup.
Configure organization SSO with OIDC
If your plan includes SSO, open Settings → SSO / OIDC. Under OIDC Configuration, enter your identity provider's Issuer URL, Client ID and Client Secret. Convor supports one OIDC configuration per organization. A Client Secret is required when setting up SSO or changing the issuer or client ID. You can leave it blank when editing an already configured provider without changing those values. Keep the secret in your credential store. Test Connection only checks discovery and reachability for the OIDC issuer URL. It does not verify the Client Secret, client credentials or a complete sign-in. Before switching on Enable SSO, try signing in with an authorized test account and confirm the expected role.
Map IdP groups to Convor roles
Under IdP group mappings, choose Add mapping. Enter each IdP group or role and select the corresponding Convor role: Viewer, Operator or Administrator. You can set up to 100 group mappings. Duplicate group names fail validation. Group mappings are applied when SSO creates a new organization membership. Existing and invited members keep their administrator-assigned roles. If several groups match a new account, the highest mapped role wins, so reserve Administrator for trusted identity-provider groups.
Review administrative changes in the Audit log.
Was this page helpful?