Clari Integration Identity and Token Setup
Overview
Establish a dedicated integration identity before building any data flow. Treat Revenue API tokens, ingestion partner keys, and Copilot key/password pairs as separate credentials with separate rotation and revocation paths.
Prerequisites
- Named business owner and technical owner for the integration
- Target surface: Revenue API, v2 ingestion, or Copilot API
- Approved secret manager and a non-production validation boundary
Instructions
Step 1: Choose the surface
Record the exact base URL and authentication contract: Revenue API uses the apikey header, v2 ingestion additionally requires partnerkey, and Copilot uses both X-Api-Key and X-Api-Password.
Step 2: Create a dedicated identity
Use a service or integration user whose hierarchy and forecast access match the intended export scope. Do not reuse a personal administrator credential.
Step 3: Issue and escrow credentials
Generate the credential in the Clari settings exposed for the entitled product, capture it once into the approved secret manager, and record owner and rotation metadata without copying the value into tickets or logs.
Step 4: Validate the smallest read
For Revenue API, call the administrative limits read or another entitled read-only endpoint. For Copilot, list a narrowly scoped resource such as users; do not create or update CRM records during authentication testing.
Step 5: Prove effective access
Confirm the identity can see only the expected organization, forecast hierarchy, workspace, and object set. Treat an empty result separately from successful authorization.
Step 6: Document rotation and revocation
Define overlap, rollback, dependent-job restart, and emergency revocation procedures before production use.
Authentication
Send credentials only in the provider-documented headers over HTTPS. Redact all token and password values, never persist them in shell history or fixtures, and remember that revoking a Revenue API token or deactivating its owning user can break active integrations.