Customer API · Developers
Customer API applications, credentials, scopes, and webhooks
Use API Access for customer administration; use developer.smartq.tv as the authoritative endpoint and schema reference.
What this does
Use API Access for customer administration; use developer.smartq.tv as the authoritative endpoint and schema reference.
Steps
- Open Settings, then API Access.
- Review existing applications and distinguish legacy credentials.
- Choose Create Application.
- Enter the name, accept current Customer API Terms, and select eligible modules, scopes, and locations.
- Create and securely record the Client ID and one-time Client Secret.
- Configure webhooks, verify signatures, and Send Test.
- Rotate a signing secret or revoke an application only after updating dependents.
Create Application field reference
Name identifies the client; Terms acceptance records the current agreement; Modules choose product access; Scopes limit operations; Locations constrain tenant data. Required fields and conflict validation appear before creation.
Client ID, Client Secret, and OAuth
Client ID identifies the application. Client Secret authenticates token requests and is distinct from legacy credentials. Use OAuth client credentials exactly as documented in the Developer Portal.
Webhook destination lifecycle
Create or edit URL, event subscriptions, and authorized scope; Send Test verifies reachability; signing secret validates authenticity; rotate replaces signing material; delete stops that destination.
Revoke
Revocation stops new access tokens and can immediately interrupt dependent integrations. It does not convert legacy credentials.
Settings reference
| Setting | What it does | Default | Scope | Notes |
|---|---|---|---|---|
| Modules | Selects product domains | None | application | Availability and overlap constraints apply. |
| Scopes | Limits allowed operations | None | application | Grant least privilege. |
| Locations | Limits tenant records | Authorized selection | group/location | Cannot exceed administrator scope. |
| Modules, scopes, and locations | Configures modules, scopes, and locations. | Current product default shown in the UI | group or location | Requires settings editor; displayed choices are authoritative for the current account and release. |
Permissions and scope
- No Access hides or blocks the module. Read Only permits viewing but disables changes. Editor permits the documented create, edit, publish, or administrative actions within the user's assigned scope.
Mobile
- On narrow screens, open the sidebar or overflow menu to reach the same actions; labels and save behavior are unchanged unless this article says otherwise.
Application list and legacy credentials
This control is covered by the Customer API applications, credentials, scopes, and webhooks workflow.
Applies to /admin/settings/api
Create Application wizard
This control is covered by the Customer API applications, credentials, scopes, and webhooks workflow.
Applies to /admin/settings/api
Modules, scopes, and locations
This control is covered by the Customer API applications, credentials, scopes, and webhooks workflow.
Applies to /admin/settings/api
Client ID and one-time secret
This control is covered by the Customer API applications, credentials, scopes, and webhooks workflow.
Applies to /admin/settings/api
Webhook destinations, signing secret, rotation, tests, edit, and delete
This control is covered by the Customer API applications, credentials, scopes, and webhooks workflow.
Applies to /admin/settings/api
What happens next
Your change is available within the scope you selected.
Warnings
- Client secrets and webhook signing secrets are displayed only as allowed by the UI and must never be placed in Support cases.
- Rotating a webhook signing secret causes new deliveries to use the new secret; update every verifier before or during the displayed transition window.
Troubleshooting
- BevQ can be unavailable when another active application already holds the constrained BevQ module grant for overlapping scope; edit/revoke the conflicting application or choose non-overlapping authorized locations.
- invalid_scope means the requested scope was not granted. unauthorized_client indicates client/application state. Signature mismatch commonly means wrong secret, raw-body changes, timestamp handling, or wrong algorithm.
- For revoke and authorization errors, verify the selected scope, access level, required connection, and displayed validation or freshness status; retry once after correcting the cause, then create a context-rich Support case if it continues.