Connect accounts without sharing passwords
Use provider consent and only the permissions you need.
Let the owner authorize access
Use the provider’s consent screen and verify the application identity and requested access. Do not paste passwords, access tokens or API keys into a chat, support request or help search.
Keep permissions specific
Grant access only for the intended organisation, marketplace and purpose. Reading an order and issuing a refund are different privileges. A business agent should not silently acquire broader authority.
Remove access when it is no longer needed
Revoke the provider connection and stop queued work when the relationship ends. Ask the operator about retained data and deletion. An old approval must not override current membership or revoked access.
Was this helpful?
Your choice is saved only in this browser.