Configure product integration security

Integration security is how you authenticate traffic between the marketplace and your application when you use API-based product integration. Credentials secure event notifications that the marketplace sends to your configured endpoint URLs, and secure your inbound API requests—for example, when you retrieve details of an event after a notification.

This is separate from standalone versus add-on products. Standalone product is a service type: customers can buy the product without a parent product. Add-on products are sold only with a parent product. Either service type can use API integration, manual provisioning, or referral-only listing, depending on how you create the product. See Add products.

When you need this documentation

Use the topics in this section when your product uses Full Integration with API endpoints (subscription and access-management notification URLs). You configure those endpoints on Edit integration, generate credentials on Manage credentials, and implement the flows described under Separate credentials authorization type. For an overview of events, see Integration events.

Your product setup	Do you need integration security in this section?	Where to start
Full Integration and an API-integrated product type (for example, Web App, Download, Stacked Editions Web App) with endpoint URLs	Yes	Manage credentials, then Separate credentials authorization type
Web Application (manual setup)	No for event URL and OAuth flows in this section. Provisioning uses email notifications and manual resolution of pending events.	Create Manual Web App products, Manual web app integration settings
Referral Only integration type	No — the marketplace does not complete purchase or provisioning integration for the product.	Add products (Referral Only)
Unsure which product type you use	See the Add credentials column and descriptions in Product types.	—

Standalone product does not mean you can skip integration. If you chose Full Integration and an API-integrated product type, you still configure endpoints and credentials even when the product is standalone.

Recommended workflow (API integration)

1. Create the product with the correct integration type and product type. See Add products and Product types.
2. Configure integration endpoint URLs. See Edit integration.
3. Generate and save separate credentials on the Credentials page. See Manage credentials.
4. Implement validation and authorization in your service. See Separate credentials authorization type.

Separate credentials authorization type

New products use the separate credentials authorization type: distinct OAuth 2.0 client keys and secrets (or basic authentication for outbound notifications) for marketplace event traffic and your inbound API requests.

📝 Note Previously, it was possible to use shared credentials but that option is no longer available. Shared credentials use the client (consumer) key and secret to verify signed event notifications that are sent to configured endpoints, and to sign incoming API requests for product integration (for example, to retrieve details of an event). Credentials that you created with the shared credentials type continue to work. However, for enhanced security, we recommend that you migrate existing products that use shared credentials to the separate credentials type. If you do this, you cannot revert back to shared credentials after you save your changes.

See Separate credentials authorization type for implementation details. For the legacy model, see Shared credentials authorization type (legacy).