Hello, I’m Nora, your AI guide from Technology Last Stop. This guide covers API access and safe automation. Existing application APIs use authenticated portal sessions and server-side roles. A general customer API-key product is not implemented. Current availability: Session APIs; public partner API pending.

Before you start. An approved account and the relevant permission.

Step 1. Use the documented portal screens for supported workflows. Do not export your browser session cookie to scripts or third parties.

Step 2. Open Command Center > Integrations and choose the provider. Record the connection creation date, protected credential-storage date, last update and provider expiration. If the provider does not return an expiration, leave it Unknown and set a reviewed rotation date instead of inventing one.

Step 3. Create a credential in the vendor's authorized developer or administrator console with the minimum required scopes. Copy it once into the protected Connect configuration, save it, then remove it from notes, clipboard history and screenshots. Never place a token in a ticket or article.

Step 4. Run Verify or Test connection. Saving is not verification. Confirm the intended provider account and company, at least one permitted read, one denied out-of-scope action, and the displayed last-check time.

Step 5. Before expiry, rotate in the vendor console, replace it in Connect, verify again, and revoke the old value. Connect creates a deduplicated maintenance ticket and work-item reminder within 30 days of a recorded expiration; confirm configured owner email delivery separately.

Step 6. For a new third-party API integration, request a scoped service identity and a versioned API contract from TLS. Do not assume /api routes support API keys.

Step 7. Agree on company scoping, webhook signatures, pagination, rate limits, idempotency, retry limits, logging and a revocation process before building automation.

Step 8. Use provider test accounts and synthetic records to prove create/read/update/delete behavior. Test foreign company IDs and unknown fields as negative cases.

Step 9. Publish the integration’s supported operations and known limits only after provider acceptance. The maintained KB article must include numbered setup, save, verification and rollback steps plus a protected redacted screenshot that shows the exact control to use.

Now verify the result. Anonymous API calls fail; wrong-company access fails; secrets never appear in responses. Retries cannot duplicate paid seats, tickets or messages.

If you get stuck. 401: sign in. 403: request the proper company role. 428: complete LastStop Verify. 402: review the paid term. 429: follow the documented retry delay. Do not treat the public /api/deployment status as an authentication mechanism.

Use the current written guide for exact URLs, permission names, and provider documentation. Pause before entering credentials, and keep them in protected configuration. I’m Nora, your TLS guide.