Managing credentials
Graftport stores source and destination credentials encrypted at rest and scoped per migration. This page covers how credentials are set, what each field means in practice, and how to update them when they rotate.
Where credentials live
Credentials are set in two places:
- During the New Migration wizard — Step 1 sets source credentials; Step 2 sets destination credentials.
- On the migration’s Settings tab — open the migration and choose Settings. The Source and Destination panels there edit any field after the initial setup, and each panel saves on its own.
You do not need to recreate a migration when an API key rotates. Update the credential in place; the next run uses the new value.
A password or token you have already saved is never shown back to you — Graftport does not send stored secrets to the browser. The field shows as stored with a Replace button beside it. Leave it alone and it stays exactly as it is, so you can change a shop domain, a username or the migration’s name without retyping anything secret. Choose Replace only when you actually want to put a new value in.
Source credentials
The fields required depend on the source platform:
| Platform | Fields |
|---|---|
| Magento | Store domain, admin username, admin password |
| Shopify (as source) | Store subdomain (example.myshopify.com), Admin API access token |
| WooCommerce | WordPress site URL, Consumer key, Consumer secret |
| HostedShop / Dandomain / Scannet | SOAP API username, SOAP API password |
See Sources → Magento, Sources → Shopify (as source), Sources → WooCommerce, and Sources → HostedShop for the exact permission requirements per platform. The HostedShop guide also covers Dandomain classic and Scannet, which share the same SOAP API.
Destination credentials
The destination is always Shopify. The one required field is the
Admin API access token — a shpat_… value from a custom app
installed on the destination store.
There are two ways to provide it:
- Pick a connected store (recommended) — connect the store once on the Stores page and select it from the store dropdown in the wizard or on the migration’s Settings tab. The token is created and applied automatically; you never see or handle it.
- Paste the token — create the token in the Shopify admin under your own custom app and paste it into the token field.
See Destination → Shopify for the full list of read/write scopes the token must carry per resource type.
Rotating a credential
When a source API key, admin password, or destination token changes, update it before the next run:
Open the migration
From Migrations, click the migration whose credential changed.
Go to Edit
Click Edit in the header of the migration.
Update the field
Replace the old value with the new one. Only the changed field needs to be re-entered — all other fields stay as they are.
Save
Click Save changes. The new credential is stored immediately and encrypted at rest. The old value is not retained.
Validate with a new run
Start an extract-only run to verify the new credential is accepted. A successful extract confirms the credential is correct and in scope.
If you update a source credential mid-migration and the next run’s extract returns different data than the previous extract (for instance, the new API key is scoped to a different store view), the transformed and staged records from prior runs may no longer match. Re-run extract + transform before the next load.
Credential errors in runs
The most common credential failures appear at extract time:
| Error | Likely cause |
|---|---|
401 Unauthorized | Password or token rotated since the last run. |
403 Forbidden on a specific resource | The credential’s role is missing read scope for that resource. |
invalid_client on Shopify | The custom app was uninstalled from the destination store. |
Fix the credential on the migration’s Settings tab, then start a new extract run. See Troubleshooting → Common errors for a full triage table.
Service accounts
Use a dedicated, read-only service account for source credentials wherever the platform supports it. This way the merchant can revoke Graftport’s access independently, without affecting other admin users. See the individual source platform pages for recommended permission sets.
Never use a person’s day-to-day admin login for a migration credential. If that person leaves the organisation, the credential silently stops working on the next run.