{"templateId":"markdown","sharedDataIds":{"sidebar":"sidebar-sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":[]},"type":"markdown"},"seo":{"title":"Credentials and environments"},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"credentials-and-environments","__idx":0},"children":["Credentials and environments"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This page is for whoever sets up a VBAPI integration at a client organization. It explains each credential VBA issues and which header it goes in, which host and database you call, and how to keep the credentials safe."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"what-vba-gives-you","__idx":1},"children":["What VBA gives you"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["VBA issues six values. All of them come from VBA; you do not create them yourself."]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Credential"},"children":["Credential"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"What it is"},"children":["What it is"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Where it goes"},"children":["Where it goes"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["API key"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Identifies your integration to the API. Rate limits (25 requests per second sustained, 50 burst) apply per API key."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["x-api-key"]}," header on every call"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Client ID"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Part of your organization's login configuration."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["vbasoftware-client-id"]}," header when you log in"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Client code"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Part of your organization's login configuration."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["vbasoftware-client-code"]}," header when you log in"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Database name"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The VBASoftware database a call reads from or writes to."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["vbasoftware-database"]}," header on every call, including login"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Username"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The VBASoftware user your integration logs in as."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Basic authentication on ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["POST /user-authentication"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Password"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["That user's password. A new user may first have to replace a temporary password; see the ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/developer-portal/get-started/quick-start#if-login-asks-for-an-extra-step"},"children":["Quick start"]},"."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Basic authentication on ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["POST /user-authentication"]}]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Logging in with ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/openapi/vbasoftware/vbasoftware.api/user/userauthentication"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["POST /user-authentication"]}]}," returns an ID token, which every other call sends as ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Authorization: Bearer <idToken>"]},". ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/developer-portal/concepts/authentication"},"children":["Authentication and tokens"]}," explains token lifetime and renewal."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"request-credentials","__idx":2},"children":["Request credentials"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Contact your VBA Account Executive to request an API key and the other values. ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/developer-portal/help/support#contact-vba"},"children":["Support and escalation"]}," lists the other ways to reach VBA."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"environments","__idx":3},"children":["Environments"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Clients use one host, the production API:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"text","header":{"controls":{"copy":{}}},"source":"https://vbapi.vbasoftware.com/vbasoftware\n","lang":"text"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["There is no separate client sandbox host. You choose the database on every request with the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["vbasoftware-database"]}," header, so the database name you were given decides whose data a call reads or changes."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Because every call reaches production, write calls (",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["POST"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["PUT"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["DELETE"]},") change real records. Ask VBA whether a non-production database is available for your organization to build and test against. If it is, you call it on the same host by sending its name in ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["vbasoftware-database"]},"."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"keep-credentials-safe","__idx":4},"children":["Keep credentials safe"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Keep the API key, password, and tokens out of source code and version control. Load them from environment variables or a secrets manager."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Never log or display tokens, passwords, or API keys. Mask them in error reports."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Keep tokens in memory, not on disk, and discard them when your process ends."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Never send credentials or tokens to VBA support. The ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["debug.activityID"]}," from a response is enough to find a request."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["If a credential may have been exposed, contact VBA to have it replaced."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"next-steps","__idx":5},"children":["Next steps"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/developer-portal/get-started/quick-start"},"children":["Quick start"]},": use your credentials to make a first call."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/developer-portal/get-started/try-it"},"children":["Try it in the browser"]},": call operations from the API reference."]}]}]},"headings":[{"value":"Credentials and environments","id":"credentials-and-environments","depth":1},{"value":"What VBA gives you","id":"what-vba-gives-you","depth":2},{"value":"Request credentials","id":"request-credentials","depth":2},{"value":"Environments","id":"environments","depth":2},{"value":"Keep credentials safe","id":"keep-credentials-safe","depth":2},{"value":"Next steps","id":"next-steps","depth":2}],"frontmatter":{"title":"Credentials and environments","description":"The credentials VBA issues for VBAPI, where each one goes, how to request them, and how to keep them safe.","seo":{"title":"Credentials and environments"}},"lastModified":"2026-10-26T21:09:33.692Z","pagePropGetterError":{"message":"","name":""}},"slug":"/developer-portal/get-started/credentials-and-environments","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}