Administration

Connect APIs with the Integration Hub

Configure authenticated API operations, field mapping, queued synchronization and signed webhooks.

How to do it

  1. Open Administration → Integrations. Connected Apps shows configured connections and verified-request status. Marketplace distinguishes native store synchronization, configurable APIs and adapters still required.
  2. Create a connection with an HTTPS API origin and encrypted credentials. OAuth2 uses Authorization Code with S256 PKCE; register https://login.supachrome.com/api/integration-hub/oauth with the provider. Required runtime credential encryption uses the existing SUPAGENT_CREDENTIAL_KEY.
  3. Open Data Mapping to define a request method, relative endpoint, non-secret headers and request body. Request mode supports JSON, XML and CSV transport. Import mode requires GET JSON and an array of at most 100 records per page. Map source field paths to destination fields and select transformations. Every record needs an external ID; existing record validation and upsert rules apply.
  4. Configure page-number and page-size parameter names if supported by the source API. A modified-since parameter uses the last completed synchronization watermark. Cursor pagination and arbitrary transformation scripts are not implemented. Import permission and destination object write access are rechecked against the operation owner.
  5. Run an operation manually and inspect Logs. GET operations also offer a limited credential-redacted response preview. Scheduled intervals and event scans run through the existing signed marketing worker; configure its QStash scheduler before relying on unattended processing. Event subscriptions use the existing supported Business Events catalog.
  6. For inbound events, create an import operation, rotate its connection webhook signing secret and configure the sender using the displayed signature contract. Both event ID and operation ID are included in the signature. Duplicate events reuse the same job. Mutations with ambiguous outcomes require review unless the endpoint is explicitly declared idempotent.
  7. Use API Management for the existing ingestion API and scoped OAuth/MCP settings. /api/v1/openapi describes the new versioned REST facade over existing MCP tools. Existing approvals, scopes and BU permissions apply. This is not unrestricted CRUD across every module.

Check your result

Test a connection, map one isolated record and verify its source ID, job result and destination before enabling a schedule. No marketplace entry is considered verified until a provider request succeeds.

Good to know

SAP/Tally gateways, AWS SigV4, provider-specific OAuth extensions, unrestricted cross-module write APIs, cursor pagination, conflict-policy editors and high-volume capacity certification require further adapter or infrastructure work. Shopify/WooCommerce retain their native SupaCommerce synchronization. No real payments or customer messages should be used for validation.

Still need help?

Tell us your BU code and the step where you got stuck. Do not include passwords, BU PINs, tokens or recovery codes.

Contact SupaChrome support