Token Creation
- Admin → CWS External Sync → API Tokens
- Create token with specific scopes
- Token shown only once — copy immediately
Security
Authentication, tokens, and best practices
Tokens
API Token Management
Token Scopes
- stock:read / stock:write
- prices:read / prices:write
- products:read / products:write
Token Storage
- Stored as bcrypt hash in database
- Never use plain text files
- Use environment variables
- Rotate tokens regularly (90 days)
Access Control
IP Allowlisting
Restrict token access to specific IP addresses. Optional but recommended for production.
Format
192.168.1.100 or 10.0.0.0/8Encryption
HTTPS Requirement
All API calls must use HTTPS
HTTP requests are blocked. Tokens are sent only over encrypted connections.
File Transfer
File Transfer Security
✓ SFTP + Fingerprint
Encrypted, best practice
≈ FTPS with TLS
Encrypted, acceptable
✗ FTP Plain
No encryption, avoid production
Checklist
Production Checklist
☑ HTTPS enabled with valid SSL certificate
☑ API tokens stored in environment variables
☑ IP allowlist configured
☑ Use minimal scopes per token
☑ Set token expiration dates
☑ SFTP with host key verification
☑ Monitoring and logging enabled
☑ Backup and disaster recovery plan
