When a COINS credential is compromised or expires, it needs replacing quickly to protect your data and maintain system stability. This article covers how to rotate each credential type in COINS ERP+ and when to contact the Access Digital support team. You need system administrator access in COINS ERP+ to complete these steps.
⚠️Warning: If you suspect active compromise of any credential, contact the Access Digital support team immediately before starting any rotation steps.
REST API authentication
The COINS REST API uses standard COINS user credentials (username and password) for authentication. If an account used for REST API access is compromised, change the password immediately and update any systems that use it.
Log in to COINS ERP+ as a system administrator.
Go to User Workbench and open the affected user record.
Reset the user's password and click Save.
Update any external systems or integrations that authenticate with the REST API using this account.
Test the API connection to confirm authentication is working correctly.
📌Note: Use a dedicated service account for REST API integrations rather than a named user account — this makes credential rotation simpler and avoids disrupting other users. Confirm that the system parameter SY/PWDHASH is set to a non-blank value, as this is required for REST API authentication to work.
Third-party integration API keys
API keys for third-party integrations are stored as COINS system parameters. The parameter name varies by integration — a common example is SY/MAILPWD, which holds the password or API key for email services such as SendGrid or SMTP. To replace an integration API key:
Log in to COINS ERP+ as a system administrator.
Open System Parameters and search for the parameter holding the API key for the affected integration.
Replace the existing value with the new API key provided by the third party.
Click Save.
Test the integration to confirm it is working correctly with the new key.
📌Note: If you are unsure which system parameter holds the API key for a specific integration, contact the Access Digital support team or refer to the relevant integration guide.
SSL certificates
SSL certificates secure the HTTPS connections for your COINS ERP+ environments. Expired or compromised certificates cause connection failures and browser security warnings.
⚠️Important: SSL certificate replacement requires server-level access and must be carried out by the Access Digital technical team. Raise a support case if your certificate has expired or been compromised.
Identify a certificate needing renewal
Open your COINS ERP+ URL in a browser.
Inspect the site certificate and check the expiry date.
If the certificate has expired or expires within 30 days, raise a support case with the Access Digital team immediately.
Replace an SSL certificate
Obtain the new SSL certificate and private key from your certificate authority.
Raise a support case with the Access Digital team and attach the new certificate files.
Request that installation is scheduled during a maintenance window to minimise disruption to users.
Once the Access Digital team confirms installation, test access to COINS ERP+ across all environments (LIVE, UAT and LEARN) to verify the new certificate is active.
PGP keys
PGP (Pretty Good Privacy) keys encrypt data exchanged with external systems via SFTP and other file transfer integrations. The location of PGP key configuration in COINS ERP+ varies by integration.
⚠️Important: Contact the Access Digital support team before making changes to confirm where your PGP key is configured. Updating the wrong key or integration could disrupt file transfer processes.
Generate a new PGP key pair
Use a key management tool such as GPG to generate a new PGP key pair.
Export the new public key — this is the key you share with external parties.
Store the private key securely in your organisation's key management system.
Update your PGP key in COINS
Log in to COINS ERP+ as a system administrator.
Navigate to the PGP key configuration screen for the relevant integration. Contact the Access Digital support team if you need help locating this.
Replace the existing key with the new private key and click Save.
Share your updated public key with any external parties that send you encrypted files.
Confirm with those parties that they have updated their configuration before you revoke the old key.
Run a test file transfer to confirm encrypted data is decrypted correctly.
After rotating credentials
Complete these steps after replacing any credential to confirm everything is working and old credentials cannot be misused.
Test all affected integrations and connections across every environment.
Revoke or delete old credentials immediately to prevent misuse.
Update any internal documentation, password managers or vaults that stored the old credential.
Notify your internal teams and any connected external parties of the change.
Raise a support case with the Access Digital team if any integration fails after rotation.