Connectors
Tokens and permissions
What each platform asks for, and the least access that works.
Most connectors are authorized with an API token you create in your own platform and paste into Inverity. This page covers what those tokens need to be able to do, and how to keep the access tight.
What Inverity needs to be able to do
Whatever the platform, a working connector needs two capabilities:
- Read the assets in the locations you point it at.
- Add or update assets in those same locations, so optimized results can be written back.
That's it. Inverity does not need permission to delete assets, manage users, change settings, read orders or customer data, or publish content. If your platform's permission model lets you scope a token narrowly, scope it to media and nothing else.
What each platform asks for
| Platform | Credentials |
|---|---|
| HubSpot | OAuth sign-in — no token to create |
| Webflow | OAuth sign-in — no token to create |
| Contentful | OAuth sign-in — no token to create |
| Shopify | Embedded app install from your store admin |
| Sanity | A project token |
| Storyblok | An API token |
| WordPress | An application password |
| Adobe Commerce | An API token |
| BigCommerce | An API token |
| Bynder | Portal URL + permanent token |
| Cloudinary | Cloud name + API key + API secret |
| Brandfolder | API key + Brandfolder ID |
| Acquia DAM (Widen) | Domain + API token |
| Canto | Domain + access token |
| Frontify | Domain + API token |
Each connector's setup guide has the specifics — see CMS connectors and DAM connectors.
How your credentials are stored
Tokens you provide are stored encrypted and used only to access the assets you point Inverity at. See Security and Data and privacy.
Good practice
Use a service account. Where your platform supports it, create the token under a service or integration user rather than a named person's account. If that person leaves and their access is revoked, your connector doesn't break with them.
Scope to the minimum. If the platform offers granular scopes, grant media read and write only.
Label the token. Name it something like Inverity in your platform's token list. In two years, someone auditing that list needs to know what it's for without asking.
Note the expiry. Some platforms issue tokens that expire. Put the date in a shared calendar — a silently expired token looks exactly like "optimization stopped working for no reason."
Rotate a token if it's ever exposed
If a token is pasted into a ticket, a chat message, or a screenshot, treat it as compromised. Revoke it in your platform, create a new one, and update the connector in Inverity. Revoking first is safe — the connector will report an authorization error until you paste the replacement, and no assets are at risk in the meantime.
Changing or removing access
To rotate a token: create the new token in your platform, update the connector in Inverity, then revoke the old one.
To disconnect entirely: remove the connector in Inverity, then revoke the token or uninstall the app in your platform. Do both — removing the connector stops Inverity using the credential, and revoking makes it useless regardless.
Assets already optimized stay as they are. Disconnecting stops future optimization; it doesn't reverse past work.
Common errors
- "Token is invalid" — mistyped, expired, or lacking read/write permission on media.
- "Domain not found" — for domain-based DAMs, the portal URL must match exactly what appears in your platform, including the subdomain.
- Connected, but nothing is optimized — the credential is fine; you probably haven't selected any locations to watch.
See Connector errors.