Five outside systems, and until this round only a sales channel account showed whether its own connection worked. QuickBooks, ShipStation and CheckoutChamp had no status anywhere. The last two are the likeliest to break without anyone noticing: besides an API key, each has a website sign-in that a browser uses for the few writes their APIs cannot do, and nobody has measured how long that session lasts (RI-472). CheckoutChamp also refuses an IP that is not on the allowlist with the same message as a wrong password.
A grid first, the detail one click away
Paul, 2026-09-15: the page needs a global view, so anything that has failed is visible at a glance (RI-815). One row per connection, not per system, because one eBay seller can be broken while the other works (RI-816). Rows start worst first: failing, expiring, working, not connected. Check cells hold only ✓, ✗ or —; the reason for a ✗ lives in the drawer (Paul: “I don’t think we should put it in the actual grid”, RI-817). A dash means the system does not have that check. Status is computed from the checks, never typed: any ✗ is Failing, a login inside 30 days is Expiring (RI-818).
How each system connects
ShipStation, CheckoutChamp: an API key and a website username and password, all in the environment (.env.local locally, Dokploy in production). Never typed on a screen (RI-820).
Shopify: a store key in the environment that does not expire (RI-800). Shopify stopped creating that kind of app from the store admin on 2026-01-01; an existing key keeps working, and a new store goes through Shopify’s Dev Dashboard (RI-829, open).
QuickBooks and eBay: a sign-in with Intuit or eBay (OAuth). The app’s client id and secret are in the environment, but the login itself is kept in the database, because the app must save a new one itself: QuickBooks replaces its refresh token on every use and the running app cannot rewrite its own environment (RI-821). QuickBooks’ login dies after 100 days unused and after 5 years regardless; eBay’s lasts about 18 months (RX-324).
eBay developer app is its own row: the account-deletion notice endpoint eBay’s licence requires. If it stops answering, only an email from eBay would say so (OPEN-ITEMS, eBay bring-up §2).
Which rows exist
A row for every sales channel account (active or not), and a row for every system credential set that is configured (RI-816). The fixture is the production server plus the QuickBooks sandbox, because this machine’s environment holds both sets. The QuickBooks production row is Not connected because its company id is set and its login is not — true of this machine on 2026-09-15.
Actions, and who can use them
Check now is for everyone. Sign in again (ShipStation, CheckoutChamp) and Connect / Reconnect (QuickBooks, eBay sellers) are admin only, because they change a live credential (RI-822). Toggle Viewing as to see the operator view. Shopify and the eBay app have no connect button: their keys are changed in the environment (RI-800).
Alerts
A red banner on every screen while anything is failing (_integrations.js, MR-406 — the same rows this grid reads, so the two cannot disagree; here its button filters the grid, elsewhere it opens this page), plus a message to the people picked under Alerts and to the Slack webhook. Expiring logins do not raise the banner; they send a message at 30 days and at 7 days (RI-824, RI-825). The Slack webhook is a secret, so it lives in the environment and the page only says whether it is set (RI-826).
Email recipients are users, picked (MR-405, RI-831). Paul, 2026-09-15: “should we just be able to multi-select different users in the system? Instead of entering their email by text”. A typed address can be mistyped and nothing says so, and it keeps receiving after the person leaves. A picked user is sent to at the email on their account, and a disabled user is not offered and stops receiving. Free-text addresses are rejected (RI-832).
The sales channel account screens
Integrations and the account screen read the same check results, so they cannot disagree (RI-827). Since MR-406 the account screen’s Reconnect / Connect is a link to this page with that account’s drawer open, and its status and checks stay where they are (RI-834). The listings grid’s Reconnect the account link comes here too.
Rejected
Five cards, no grid: answers “is anything broken” only after reading all five (RI-828).
The failure reason in the grid: Paul wants symbols there (RI-817).
Integrations for the three shared systems only, Shopify and eBay left on the account screens: Paul chose all five on one page (RI-830).
Open — needs Paul
1. A new Shopify store after 2026-01-01 goes through Shopify’s Dev Dashboard. Whether that still ends in a key that never expires is unchecked (RI-829).
2. How long ShipStation’s and CheckoutChamp’s website sign-ins last is still unmeasured (RI-472), so the grid cannot yet warn before one goes stale.
Fixture values are in SAMPLE-DATA.md § Integrations. The account-screen link and the banner everywhere were OPEN-ITEMS P103 and P102, closed by MR-406.