Manage API Authorization

Updated: 2026-09-23

1. Scenario

API Authorization generates the credentials an ERP needs to connect to GWMS. An ERP can only push orders, products, and other data into GWMS, or pull data from GWMS, after it holds these credentials.

Use this page when:

1. You decided to integrate an ERP and need to generate its credentials on the GWMS side.
2. You need to fill in credentials on the ERP side and do not know where to obtain them.
3. An ERP is no longer needed, or its credentials may have leaked, and you need to suspend its access.
4. An integration stopped working and you need to check whether the authorization is still enabled.

Do not use this page when:

1. You want to add a new ERP vendor. Authorize it first under GWMS-Platform Management-ERP Authorization.
2. You want to maintain a store authorization on an e-commerce platform. Use GWMS-Platform Management-Store Authorization.
3. You need request formats, parameters, or response fields for a specific interface. Refer to the developer documentation.

2. Operation Guide

Prerequisites

Confirm the following before you start:

1. Your account can access GWMS-Platform Management-API Authorization.
2. The target ERP is already authorized under GWMS-Platform Management-ERP Authorization and its status is enabled.
3. You confirmed which ERP you want to integrate, so you do not generate credentials for an ERP you will not use.

Handling flow

1. Open GWMS-Platform Management-API Authorization and confirm that no record exists for the target ERP.
2. Click 【Add】, select the ERP, and submit. The system generates the credentials for that ERP.
3. Copy clientId, clientSecret, and apiKey from the list and paste them into the ERP.
4. When the integration is no longer needed, click 【Disable】 to suspend the authorization.

2.1 Open API Authorization

Menu path: GWMS-Platform Management-API Authorization

The list is grouped by customer code, and each row within a group represents one ERP:

Field	Description
Customer Code	The customer that owns the authorization. Rows are grouped by customer code, so multiple ERPs of one customer appear in one group.
ERP Count	Number of ERPs that already have credentials for this customer.
ERP	Name of the authorized ERP.
clientId	Client identifier of the ERP.
clientSecret	Client secret of the ERP.
apiKey	Integration key of the customer.
Created Time	When the credentials were generated.
Status	Enabled or disabled.

You can filter records by 【ERP】 and 【Status】. Customer accounts do not see the 【Customer Code】 filter and only see their own authorizations.

2.2 Add an API authorization

1. Click 【Add】 to open the dialog.
2. Select the ERP you want to integrate from the 【ERP】 dropdown.
3. Click 【OK】. The system generates credentials for that ERP and adds a row to the list.

The dropdown only lists ERPs that are already authorized and enabled under ERP Authorization. If the ERP you need is missing, authorize it under GWMS-Platform Management-ERP Authorization, confirm it is enabled, and then come back to this page.

One ERP only needs credentials once. Adding the same ERP again does not create a second independent record and does not refresh the existing credentials.

2.3 View and copy credentials

Each credential in the list has a copy button on its right. Click it to copy the full string; you do not need to select the text manually.

• apiKey: generated by the customer on this page. It represents the customer's consent for an external system to access that customer's resources in GWMS. For example, if an ERP needs to push data into GWMS, you generate the apiKey here and then enter it in the ERP.
• clientId and clientSecret: the client identifier and secret of the selected ERP. They are issued by the ERP vendor and allocated per ERP, so they are shared by all users of the same ERP.

Paste the copied values into the corresponding ERP configuration immediately and store them safely. If clientId or clientSecret shows -, that ERP has no client credentials configured yet; contact your system administrator.

2.4 Disable and enable

The action column of each row offers 【Disable】 or 【Enable】:

• When the authorization is enabled, the button shows 【Disable】.
• When the authorization is disabled, the button shows 【Enable】.

A confirmation dialog appears before the change takes effect. Disabling immediately breaks the connection between that ERP and GWMS: requests from that ERP to push or pull data are rejected. Re-enabling restores the connection.

The current version does not support deletion. When an ERP is no longer used, disable it. There is no need and no way to delete the record.

3. Notes

3.1 Roles of the three credentials

Credential	Who issues it	Scope	Purpose
apiKey	Generated by the customer on this page	The current customer	Identifies and verifies the customer, and decides which of that customer's GWMS resources an external system may access
clientId	Issued by the ERP vendor	Shared by the same ERP	Identifies the connected ERP system
clientSecret	Issued by the ERP vendor	Shared by the same ERP	Used together with clientId to verify the ERP identity

An ERP usually needs all three values. Where to enter them depends on that ERP's own integration documentation.

3.2 Status

Status	Meaning	Integration available
Enabled	Authorization is active	Yes
Disabled	Authorization is suspended	No, requests are rejected

3.3 Credential security

• These three credentials are equivalent to an account password. Anyone who holds them can access GWMS resources as the customer. Do not share them through chat tools, email bodies, or public screenshots.
• When staff change, or when the people who configure the ERP change, review whether the existing authorization should be kept.
• If you suspect a credential leaked, first 【Disable】 the authorization on this page to block access, then contact your system administrator for replacement.

4. FAQ

Q1: The ERP I need is missing from the dropdown. What should I do?

That ERP is not enabled under ERP Authorization yet. Authorize it under GWMS-Platform Management-ERP Authorization, confirm its status is enabled, and then add the API authorization here.

Q2: Can I regenerate or rotate the apiKey?

The current version does not support regenerating an apiKey on this page. Contact your system administrator if you need a replacement. Before the replacement is done, you can 【Disable】 the authorization to block access.

Q3: Does disabling an ERP authorization affect orders already in GWMS?

No. Disabling only blocks interface access between that ERP and GWMS. Orders, inventory, and other data already in GWMS are unaffected and can still be processed on their own pages.

Q4: Why do several ERPs of the same customer share the same clientId?

clientId and clientSecret are issued by the ERP vendor and allocated per ERP, so all users of the same ERP share one set of client credentials. Different customers are distinguished by their own apiKey.

Q5: Can I delete an authorization from the list?

No. Disable any authorization you no longer use. After it is disabled, that ERP cannot reach GWMS, and the record is kept for traceability and for re-enabling later.