Create an app and a credential

An organization owner or admin sets up access in the Gateway console. You’ll create an application that describes what the integration may reach, an installation of it, and an expiring credential whose token the integration sends.

One app per integration

Create a separate application, or at least a separate credential, for each integration and each AI agent. You can then revoke one without affecting the others.

Before you begin

• You’re an owner or admin of the organization in the Gateway console.
• You know the website IDs the integration needs, for example web_4927_123.
• You know which data the integration needs. Start read-only and add more later.

Create the application

1. Open Applications in the console and select Create application.

2. Choose the Application organization and enter an Application name. Add a Description so other admins know what it’s for.

3. In Website IDs, enter the enrolled websites the integration may reach, separated by commas.

4. Under Supported scopes, select only the scopes the integration needs. See scopes and permissions for what each one allows.

5. Under Data access, turn on Message content, Personal information (PII) or Internal notes only if the integration needs them. These flags never replace scopes; both are required.

6. Optionally limit the application with Restrictions (JSON), using channel_ids, team_ids or subsite_ids:

   { "team_ids": ["team_4927_123_5"] }

   An empty list denies every row in that dimension. Operations that can’t apply these filters, such as contacts and configuration, become unavailable to a restricted application.

7. If the integration will add visitor notes or set dispositions, set Author mappings (JSON). Map each website to the native INSIDE operator the change is attributed to:

   { "web_4927_123": 1042 }

   A mapping only controls attribution. It doesn’t give the application that operator’s permissions.

8. Select Create application.

Install it

1. Open the application and select Create installation.

2. Enter an Installation label that says where it runs, for example Warehouse integration — production.

The installation inherits the application’s websites and scopes. You can Suspend installation at any time; it takes effect on the next request.

Issue a credential

1. On the installation, open Issue installation credential.

2. Enter a Credential name and choose when the Credential expires. Prefer short expiries and rotate regularly.

3. Optionally narrow the credential with Narrow credential scopes or Narrow credential websites. A credential can only narrow its installation, never widen it.

4. Select Issue credential.

5. Copy the token now. It starts with igw_live_ in production or igw_test_ in development, and it’s shown only once. Store it in a secret manager or environment variable.

The credential ID shown in the list, such as cred_…, is also its OAuth client ID. The token is the client secret when you use OAuth client credentials.

Keep tokens out of code

Never put a token in source control, a prompt, a URL or a log. If a token leaks, revoke or rotate the credential straight away.

Rotate or revoke

Action	Effect
Rotate credential	Issues a replacement token with a new expiry. The old token stops working immediately.
Revoke credential	Stops the credential on its next request.
Suspend installation	Stops every credential of the installation until you reactivate it.

Next steps

• Make your first request
• Connect an AI agent
• Choose an authentication method