Restrict an API Key (API Access)
Every sales channel has its own API key. With the block API access you choose which parts of the QrX API that key may use, for example when a partner or an external system should only read stock.
Where to Find It
Go to Settings > Business > Merchant Channels, open the sales channel and choose the tab Settings. The block API access is under the API key. You need the permission Manage Channels to change it; other users can only see it.
Full Access and Restricted
Full access: the key may use every part of the QrX API, also parts that QrX adds later. Every key starts like this. The exception is the CRM: a CRM call is only accepted when the CRM part is ticked, so to use the CRM API you restrict the key and tick it (see below).
Restricted: the key only works for the parts you ticked. A call to another part is refused with a 403 error.
The Parts You Can Tick
Returns: Read returns (
returns.read), Create and change returns (returns.write), Book received returns (returns.receiving.write), Decide how a return is resolved (returns.resolutions.write), Send messages on a return (returns.messages.write), Manage return webhooks (returns.webhooks.manage).Inbound: Read inbound deliveries and receipts (
inbound.read), Announce, receive and change inbound deliveries and receipts (inbound.write).Stock: Read stock levels, items, locations, movements, counts and containers (
stock.read), Adjust stock and create or change items and locations (stock.write).Purchasing: Read purchase orders and their prices (
purchasing.read), Create, send and close purchase orders (purchasing.write).Fulfilment: Read pick lists (
fulfilment.read).Tasks: Read team tasks (
tasks.read).CRM: Read CRM people, companies, deals and pipelines (
crm.read), Create and change CRM people, companies, deals and notes (crm.write). The CRM tasks and activities endpoints use the read part.
The restriction covers these returns, inbound, stock and CRM parts of the API. Creating transactions, labels and products with the key is not in the list and keeps working.
Restrict a Key
Switch on Restrict this key.
Tick the parts the key may use. Tick at least one.
Click Save API access. The block saves on its own.
QrX asks Restrict this API key? and lists under Stops working what the key can no longer do. Check the list and click Restrict the key.
Be careful: every part that is not ticked stops working at once, also for integrations that work today. A returns or inbound integration that used this key without any restriction gets an error as soon as its part is not ticked. Parts that QrX adds later are off for a restricted key until you tick them.
The 30 Second Delay
A change can take up to 30 seconds to apply. During that time a call can still be accepted or refused by the old setting. Wait half a minute before you test.
Back to Full Access
Switch off Restrict this key and click Save API access. The key shows Full access again.
Frequently Asked Questions
My integration suddenly gets a 403 error. What happened?
Someone restricted the key and the part your integration uses is not ticked. For stock the error code is STOCK_SCOPE_MISSING. Tick the part, save and wait 30 seconds.
A CRM call gets a 403 error with the code CRM_SCOPE_MISSING. What now?
The CRM part is not ticked on the key. Switch on Restrict this key, tick CRM (read, write or both), save and wait 30 seconds. See "CRM public API".
Does restricting change the key itself?
No. The key and its access tokens stay the same; only what the key may do changes. To replace the key itself, use Regenerate API Key. See "Webhooks and API Keys in PortalX".
When to Contact Our Support Team
Contact QrX support when a ticked part is still refused more than a minute after saving. Include the sales channel, the endpoint and the time, never the key or the token.