Good practices for identifiers

Login identifiers include API keys, customer secrets, tokens, shop URLs and account or property identifiers.

Essential rules

• generate IDs dedicated to ELChat when possible;
• grant only the permissions requested in the connector official form;
• keep the secrets in a manager for this purpose;
• do not place them in an imported document, in a field of knowledge, or in a conversation;
• do not reuse an exposed key: revoke it and replace it;
• remove access when an employee or provider leaves the project.

Rotation

To replace a key or secret:

1. Create the new ID on the external platform;
2. Inform in the connector settings;
3. Test a reading then, if necessary, a controlled writing;
4. revoke the old ID on the platform;
5. check that the relevant workflows still work.

With OAuth, use Reconnect when the token has expired or the permissions have changed. The plug of each connectorspecify the identifiers actually expected.

Example of uninterrupted rotation

For a WooCommerce key:

1. Create a new keyELChat — 2026-09with the same perimeter;
2. replace the value in ELChat;
3. test the reading of a product and a controlled writing if necessary;
4. revoke the old key in WooCommerce;
5. check the dependent workflow again.

The new key is tested before revocation to avoid a cut. The date in its name helps to find access to delete, but does not replace permission control.