The methods
OAuth
You authorise Bonx from within the tool, never handing over your password. Bonx receives a revocable token and
renews it on its own. This is the preferred method whenever the tool offers it.
API key or token
You generate a key in the tool and paste it into Bonx. Revocable from the tool at any time, and scopable to just the
rights needed.
Application credentials
A service account dedicated to the integration, with its own rights. Preferable to a personal account, which breaks
the connection the day that person leaves.
File drop (SFTP)
For standardised exchanges such as EDI, or tools without an API. Files transit through an agreed folder, with
credentials or a key.
Protecting secrets
The tokens, keys and credentials you entrust to Bonx are encrypted at rest and are never shown in clear again after saving: you can replace them, not read them. They do not appear in logs or exports.Good practice
- Create a dedicated account or key for Bonx, not a personal one.
- Limit rights to the scope actually synced.
- Revoke from the tool when you stop an integration: that is what cuts access for certain.
For access to the Bonx API from your own tools, the direction is the opposite of the one described here: see
Authentication.