Request Merchant Credentials

This article is for fulfillment providers (3PLs) connecting a store on a merchant’s behalf. Rather than collecting a merchant’s store credentials yourself, you email them a secure link, they connect their own store, and then you finish the connection. On some platforms this is the only route open to you; on the rest it’s a choice. If you manage your own DropStream account and store, you’ll see an Authorize button in the Add Connection wizard instead and don’t need this page.

The request comes before the connection, not during it. You don’t open the Add Connection wizard first — you send the request, wait for the merchant, and run the wizard once at the end.

When you’ll use this

Use a credential request whenever the store platform authorizes through the merchant’s own account and you don’t hold their login.

On most platforms it’s optional — a convenience when you’d rather not collect the merchant’s credentials yourself. If you already have them, you can enter them in the Add Connection wizard instead.

Amazon Marketplace is the exception. Amazon only lets the account owner authorize access, so a credential request is the only way a 3PL can connect an Amazon store — see Amazon Marketplace - Connect Your Store.

The Store platform list in the request dialog shows which platforms support this.

Send the request

1. In the left navigation, click Connections. In the top-right, click the arrow next to Add Connection, then click Request merchant credentials.

   

2. Select the Store platform. This is the one thing the merchant can’t change, so make sure it matches the store you’re onboarding.

3. Enter the Merchant email. The secure link goes to this address.

4. Optionally select a Merchant. This pre-selects the merchant in the connection wizard later; you can also pick or create one when you finalize.

   

5. Click Send Invitation. DropStream emails the merchant and takes you to the Merchant Invitations page.

Tell your merchant it’s coming. An unexpected request for store credentials is easy to miss or mistake for phishing, and the link expires in 48 hours.

What your merchant receives

The merchant gets an email with a secure link. Opening it brings them to a page naming your company and the platform you asked for:

Most platforms ask the merchant for one identifying detail first — the shop name, say, or the marketplace their store sells in — and then hand them to the platform’s own sign-in to approve access. Their login credentials are never shared with you: DropStream receives the authorization, not their password. Where a platform uses API keys rather than a sign-in, the merchant submits those keys through the same secure form.

When they finish, you’re emailed that the connection is ready to finalize.

Track invitations

From the Connections page, click Merchant Invitations. Every request you’ve sent appears here with its current status.

Click the request to open its detail page, which shows the full timeline and an audit trail — when the link was sent, opened, and authorized, and from where.

Each row’s ⋮ menu offers the actions that apply to its status:

• Resend invitation — emails a fresh link. The previous one stops working.
• Cancel invitation — revokes the request. The link sent to the merchant stops working.
• Ask merchant again — appears on a request that needs attention, and on reauthorization requests. It discards what the merchant already supplied and emails them a new link.

Finalize the connection

When a request reaches Ready to finalize, click Finalize on its row. The connection wizard opens with the merchant’s store already attached, so the store side is settled: you can’t pick a different platform or an existing store, because the credentials belong to the one the merchant connected.

Work through the remaining steps — name the connection, choose or create the merchant, and authorize the warehouse — then click Add connection. The warehouse step is the only credential work left, and you only do it once.

The new connection appears in your Connections list, disabled by default — see Enable, Disable, or Delete a Connection to turn it on.

When an invitation needs attention

A new-connection request lands in Needs attention when the platform refuses to refresh the credentials the merchant supplied — usually because access was removed on their side after they authorized. The row says Merchant’s access was revoked, and Finalize is withdrawn until it’s resolved.

Use Ask merchant again to email them a fresh link. (Reauthorization requests have a second way to land here — see Ask a merchant to reauthorize an existing store.)

Ask a merchant to reauthorize an existing store

Requesting credentials for a store that already exists works differently: you start from the store, not the Connections page.

1. Open the store’s settings from the Connections list, and find its credentials card.
2. Click Ask merchant to reauthorize — or Ask merchant to update credentials on platforms where the merchant submits API keys.
3. Enter the merchant’s email and click Send request.

A reauthorization is never finalized. The moment the merchant authorizes, the new credentials replace the store’s old ones and you’re emailed that it’s done. The card shows who the request went to and when the link expires until it’s answered; the request also appears on the Merchant Invitations page, labeled Reauthorize with the store’s name.

If the merchant authorizes a different account from the one the store is connected to, nothing changes — the store keeps its existing credentials. The request moves to Needs attention, marked Merchant authorized the wrong account, and the card switches to Ask merchant again. Confirm which account is right with the merchant before sending a new link.

Notes

• Links are single-use and expire after 48 hours.
• You never see or handle the merchant’s platform login.
• One request allows five sends in total, counting the original — so four resends. The detail page tracks how many are used. Ask merchant again counts as a send too.