Use API credentials when a plugin, such as the WordPress integration, needs to connect to Boris. Each credential is linked to one workspace and can be restricted to a site domain.

Create the credentials

  1. Open My account → API Keys in the panel.
  2. Enter a name that identifies the use, such as WordPress - site bookings.
  3. To restrict use to a domain, enter the external site URL.
  4. Choose the workspace the integration can access, then create the key.
  5. Copy the API Key and API Secret straight away: the secret is shown only once.

Connect them to the plugin

Paste both credentials into the corresponding fields in the plugin settings. If you set a site restriction, use the exact URL registered there. Follow the plugin guide to finish connecting, then check that the site is using the intended workspace.

Protect and disable a key

  • Store the secret in the plugin's private settings. Do not publish it in code, repositories, screenshots, or messages.
  • The name and URL help you identify each credential; access to data is limited to the selected workspace.
  • If the secret is lost, create replacement credentials and update the plugin. Boris cannot show the old secret again.
  • When an integration is no longer used or exposure is suspected, disable its key under My account → API Keys. The integration will no longer authenticate with it.

Disabling the old credential may interrupt the connected site. Coordinate the change and verify the replacement connection before disabling the old key.

Did this answer your question?