Find your ReferralCandy API Access ID and API Secret ID in Account > Profile > API Tokens. If your API secret has been shared or exposed, reset it, update the integrations that use it, and revoke the previous secret. These settings are available to Shopify merchants and merchants on other platforms.
Find your API credentials
Open ReferralCandy: from Shopify admin, open the ReferralCandy app; on other platforms, sign in to your ReferralCandy dashboard.
Go to Account > Profile.
Find the API Tokens section. It contains your API Access ID and API Secret ID.
If an integration asks for your ReferralCandy API Secret Key or Secret Key, use the value labeled API Secret ID here.
Reset your API secret
Resetting your ReferralCandy API secret creates a new secret immediately. API requests signed with the previous secret are accepted for 7 days after the reset, unless you revoke the previous secret sooner.
The seven-day allowance applies only to API requests. Immediately update any webhook verification, purchase-tracking snippets or store-plugin settings that hold your secret; these uses require the new secret as soon as you reset it.
If your API secret was exposed, reset it, update your integrations and revoke the previous secret promptly. Resetting alone leaves the previous secret accepted for API requests for 7 days.
In ReferralCandy, go to Account > Profile > API Tokens.
Click Reset API Secret. In the confirmation dialog, click Reset API Secret again.
Use the new API Secret ID to replace the old secret in each integration or script that uses it.
Once your integrations use the new secret, click Revoke previous API Secret. In the confirmation dialog, click Revoke previous API Secret again. API requests signed with the previous secret are rejected immediately; requests signed with the current secret are unaffected.
Keep your API secret private
Don't share your API Secret ID in support chat, email, screenshots or code samples. A full string prepared for MD5 signature calculation contains the secret too.
When asking for troubleshooting help, replace secrets with placeholders such as YOUR_API_SECRET and remove customer details from code, requests and responses. Calculate signatures with the real secret only in your own environment.