Handle and revoke credentials safely

What this does

Hosted configuration credential leaves are encrypted at rest with AES-256-GCM. Browser views keep them masked, and settings and account exports retain their documented redaction boundaries. Keep credentials narrow and revoke them at the service that issued them.

Before you begin

• Know which store or provider each token, API key, or store connection belongs to before you save it.
• Keep access to the issuing account (Shopify, Etsy, Gelato, Printify, Printful, your storage account) so you can create and revoke credentials there.

Steps

1. 01

   Create a narrow credential

   In the issuing service, make a token or key for the exact shop or provider you are connecting, with only the access ArtDrop's connection screen asks for. Do not hand over a broad account-wide key when a scoped one will do.

2. 02

   Save it on the matching card

   A provider or destination shown as selected in the page is not proof it was saved. Keep the page open and reload the exact provider card before a drop. If the selection reverts or no result appears, do not route work there.

3. 03

   Understand storage, view, and export boundaries

   Hosted configuration credential leaves are encrypted at rest with AES-256-GCM. Browser views keep secret values masked. Settings and account exports redact their documented configuration fields, but the settings backup still appends three legacy template arrays without the main-config redaction pass. Inspect every JSON file before sharing it.

4. 04

   Test the connection

   Verify one controlled artwork with the intended storage service and provider before sending a batch.

5. 05

   Rotate by replacing first

   Create the replacement at the issuer, update ArtDrop, and test it before revoking the old credential. This sequence reduces the chance of interrupting new work, but does not guarantee that work already in flight is unaffected.

6. 06

   Revoke at the issuer, not just here

   To fully cut off access, remove the ArtDrop record and then revoke or uninstall the credential in the external account. Clearing a token inside ArtDrop stops ArtDrop from using it, but only the issuer can turn it off everywhere.

Expected result

Saved hosted credential leaves are encrypted at rest, browser views remain masked, and any exported JSON has been inspected within its documented redaction scope. The old credential is revoked at its issuer.

Good to know

• AES-256-GCM encryption at rest does not change credential scope or revoke a credential at its issuer. Masking and export redaction are separate safeguards.
• Removing a credential from ArtDrop does not revoke it at Shopify, Etsy, Gelato, Printify, Printful, or your storage account. Revoke at the issuer to end access.
• Settings export applies its key-name credential pattern and identity list only to the main config, then appends three legacy template arrays without that redaction. Plain provider and store IDs can also remain. Inspect the JSON.
• If a save, connection, or account action has no confirmed result, do not assume success or failure, and do not retry immediately. Reload the exact store, provider, voice, license, or external destination before retrying.

Troubleshooting

• Suspect a credential leaked? Revoke it at the issuing service first, then create a fresh one and save it on the same card.
• Repeated 401 or 403 responses can mean a revoked or expired credential, the wrong account, or insufficient scope. Inspect the issuer and test a correctly scoped replacement instead of repeatedly sending the old value.

How to undo or clean up

Revocation happens at the issuer. Removing the ArtDrop record alone stops ArtDrop from using the credential but does not turn off access at the external service.