Watch the overview
About 2 minutes. A narrated explainer; the transcript is below. The written guide includes additional detail.
Read the video text
- 0:00Harbour Roads Training wants another program to use supported platform features. Normal browser uploads do not require an API connection key; this lesson is for integration setup.
- 0:10Connections lists named keys and their short references. An authorised user can create or disable keys according to the permissions available to them.
- 0:20Choose a name that identifies the program and purpose, such as Training import service. A useful label helps later investigation and retirement.
- 0:29A newly created key is shown once. Transfer it through your approved secret-management process, not in a training video, source-code repository, email thread or screenshot.
- 0:40Our training screen never reveals a usable token. It shows only a deliberately invalid placeholder, clearly labelled as an example.
- 0:48The short key reference identifies the record in the table. It is not the bearer secret and cannot be used as a substitute for the full key.
- 0:57Use the API documentation for the current supported endpoints and authentication format. Do not assume every browser action has an equivalent public API.
- 1:06Start with an authorised test organisation and a small, non-sensitive example. Confirm the response and expected scope before connecting a production data flow.
- 1:16The created and last-used information can help identify an unused or unexpected connection. Investigate with the responsible integration owner before changing access.
- 1:26Disabling a key stops programs using it. Plan the change and update the integration where necessary, then confirm the old key is no longer needed.
- 1:35Pause here. Name a training integration, describe where its secret belongs, and explain why a screen recording must never include the usable token.
Decide whether a key is needed
Harbour Roads Training wants another program to use supported platform features. Normal browser uploads do not require an API connection key; this lesson is for integration setup. Connections lists named keys and their short references. An authorised user can create or disable keys according to the permissions available to them. Choose a name that identifies the program and purpose, such as Training import service. A useful label helps later investigation and retirement.
Protect the secret
A newly created key is shown once. Transfer it through your approved secret-management process, not in a training video, source-code repository, email thread or screenshot. Our training screen never reveals a usable token. It shows only a deliberately invalid placeholder, clearly labelled as an example. The short key reference identifies the record in the table. It is not the bearer secret and cannot be used as a substitute for the full key.
Follow supported documentation
Use the API documentation for the current supported endpoints and authentication format. Do not assume every browser action has an equivalent public API. Start with an authorised test organisation and a small, non-sensitive example. Confirm the response and expected scope before connecting a production data flow. The created and last-used information can help identify an unused or unexpected connection. Investigate with the responsible integration owner before changing access.
Disable with a handover
Disabling a key stops programs using it. Plan the change and update the integration where necessary, then confirm the old key is no longer needed.
Separate a token label from its secret
A connection’s public label and short reference help administrators identify the integration. The usable secret belongs in approved secret storage, not a screenshot, article, support message or shared training file. The deliberately invalid training string cannot authenticate a request.
Choose the intended scope, protect credentials in the calling system and inspect actual request results. A successful authentication does not guarantee that a submitted file is structurally valid or eligible for review. Follow each returned file or job through its own processing outcome.
Practise and check your interpretation
Pause here. Name a training integration, describe where its secret belongs, and explain why a screen recording must never include the usable token.
A suitable example label is Training import service. Store the one-time bearer secret in approved secret storage; never in a video, source repository or message thread. The short reference identifies a key record and cannot authenticate a request. Use supported API documentation, test a small approved scope and coordinate disabling a key with the integration owner.
Use the signed-in onboarding library to record viewing progress and return to unfinished lessons. Watching the public article is useful for reference, but does not update your account’s lesson completion record.
Sources and scope
This guide describes the platform workflow; it does not establish a requirement of a TMH manual. Platform review and certification are described in the product documentation.