Your credentials

Saving the form returns three values. This is the only time the secret is shown — Bito never returns it in any other response. The api_key is stored on the integration record: reading the integration (getOne) returns it in response_fields (the api-key field), even though the panel does not display it. Copy both into your secret store now anyway.

Response

json

{
    "code": 0,
    "message": "Success",
    "data": {
        "_id": "6712f0a9c4d1e87b3a0f1122",
        "client_id": "69c50a2d50f7b939923a469b",
        "secret": "4f3c1a9e8b27d605f1ac93e7d284b6510ff7a3c9e15d8b2470a6cd91e83f4b27",
        "api_key": "mycompany:9ad41c0e7b3f28d5610ac94e7f1b26d8"
    },
    "time": "2025-01-15T10:30:00.000Z"
}

Value	Used for	Rotatable
`client_id`	Identifies your integration in every OAuth call and in the widget token. Permanent.	No — it is the identity itself
`secret`	OAuth client secret. Also the HS256 key you verify the one-time token with.	Yes — see rotating credentials
`api_key`	The simpler auth path: send it as the `api-key` header on Integration API calls. Format is `<username>:<token>`. Works once the integration is installed.	Yes — in the panel together with the secret, or on its own over the API

WARNING

If you lose the secret, it cannot be read back. Rotate it to get a new one — which disconnects every merchant currently connected. Store it properly the first time.

Your credentials ​

Your credentials