Replace a provider key - Millwork

Goal: Replace a provider credential without discarding the current working connection first. You are done when: the connection is active, its test passed, and the tested revision matches the new revision.

1. Complete a new secure setup

Start a new secure setup with the connection’s existing source_id and auth_scheme. Open its one-time browser URL and wait for the setup state to become completed. Follow Connect a provider through the secure setup steps, but do not create a second connection.

2. Rotate the connection

if ! curl --fail-with-body \
  --request POST \
  --header "Authorization: Bearer $MILLWORK_API_KEY" \
  --header "Content-Type: application/json" \
  --data "{
    \"handoff_intent_id\": \"$SETUP_ID\"
  }" \
  --output rotated-connection.json \
  "$MILLWORK_API_URL/source-connections/$CONNECTION_ID/rotate"; then
  echo "The replacement failed. Read rotated-connection.json before retrying." >&2
  exit 1
fi

jq '{
  status,
  test_state,
  binding_revision,
  tested_binding_revision,
  rotated_at
}' rotated-connection.json

Expected result: status is active, test_state is passed, and both revision numbers match.

3. Remove the old provider credential

Only after the new revision passes, remove or revoke the old credential in the provider’s controls.

If it fails

If the replacement fails its test, Millwork keeps the current working credential. Fix the replacement and start a new secure setup. Do not remove the old provider credential yet. Never send a provider key or one-time setup URL to support.

⌘I