NivoSync
Iniciar sesiónComprar ahora

Nivoda credentials

Where to get your Nivoda B2B API username and password, where to paste them in the plugin, and how they are stored at rest.

7 min readUpdated 2026-05-16

NivoSync needs read access to the Nivoda B2B GraphQL API to fetch diamonds, prices, certificates and stock status. The plugin authenticates with a username/password pair issued by Nivoda directly — not an API key — because Nivoda's B2B platform predates their public API offering. This page covers where to obtain those credentials, where to paste them, and how the plugin stores them once entered.

Obtaining your Nivoda credentials

The credentials are the same email + password you use to log into the Nivoda B2B portal at my.nivoda.com. If you have never used the portal:

  1. Log into my.nivoda.com with the email Nivoda sent you when your account was approved.
  2. If this is your first login, set a password when prompted. Use a long, random password — this is the credential NivoSync will store, and you do not want it shared with the password you use for the marketplace UI.
  3. Verify you can browse the catalogue at least once in the portal. NivoSync requires that the account has the Catalogue permission, which is on by default for approved buyers.

Pasting the credentials into the plugin

In your WordPress admin, navigate to NivoSync → Settings → API.

  1. In the Username field, paste the email address you use to log into the Nivoda B2B portal.
  2. In the Password field, paste the password for that account.
  3. Leave the API endpoint as the default (https://integrations.nivoda.net/api/diamonds) unless Nivoda support has explicitly given you a different URL.
  4. Click Save changes at the bottom of the form.
  5. The page reloads. If credentials are valid, a green banner reads "Nivoda credentials verified — token issued, expires in 24 hours". If they are invalid, a red banner explains why (typically: wrong password, account suspended, or IP-locked).

What happens after you save

When you click Save changes, three things happen in order:

  1. The plugin encrypts the username and password using AES-256-GCM with a key derived from your WordPress AUTH_KEY (or a fallback key generated at activation if AUTH_KEY is unset). The ciphertext is stored in the wp_ns_options table under the key nivoda_credentials.
  2. The plugin makes a POST /api/auth request to Nivoda with the credentials and receives a short-lived bearer token (typical TTL: 24 hours).
  3. That bearer token is encrypted with the same scheme and stored under nivoda_auth_token alongside its nivoda_auth_token_expires timestamp.

For every subsequent call to the Nivoda API, the plugin reads the cached bearer token, checks its expiry, and either uses it (still valid) or transparently refreshes it (expired or within 1 hour of expiry — proactive rotation per NS-SEC-104). Your username and password are never sent on a per-request basis after the initial token is obtained; they sit at rest in the database and are only re-decrypted when the token needs to be refreshed.

Verifying the connection

Two manual checks are available once credentials are saved:

  • Settings → API → Test connection button. Issues a single small searchDiamonds query against Nivoda with limit: 1 and reports the round-trip time. Use this whenever you suspect connectivity issues.
  • WP-CLI: wp nivosync api ping does the same check from the command line, useful for monitoring or deployment scripts.

If both succeed, you are ready to run your first sync. See First sync.

Rotating credentials

You may want to rotate your Nivoda password periodically (recommended every 90 days for a production system). The flow is:

  1. Log into my.nivoda.com and change your password.
  2. Paste the new password into NivoSync → Settings → API → Password and Save changes.
  3. The plugin invalidates the cached bearer token immediately and issues a new one with the new credentials.

If you forget step 2, the plugin will fail its next scheduled sync and log a 401 Unauthorized against the Nivoda API. Recover by repeating step 2; no data is lost (the local diamond cache stays in place).

Common errors

Error messageCauseFix
Invalid credentials (401)Wrong username or password, or account suspended by Nivoda.Verify by logging into my.nivoda.com with the same credentials. If portal login also fails, contact Nivoda support.
Account requires KYC completionYour Nivoda trade account has not finished approval.Complete the KYC documents Nivoda emailed you, then retry.
IP address not whitelistedSome Nivoda enterprise plans IP-lock accounts.Add your hosting provider's outbound IP to the Nivoda whitelist (Nivoda portal → Settings → API access).
Endpoint returned HTML, not JSONThe API URL is wrong, typically because of a typo or an old endpoint.Reset the API endpoint field to its default and save.
cURL error 28 (timeout)Your hosting provider's outbound HTTP is slow or blocked.Increase wp_remote_post timeout via the ns_nivoda_api_timeout filter, or check the hosting firewall.

If you see something else, copy the full error text from the sync log panel on NivoSync → Sync and email it to support@nivosync.com. Do not include your credentials in the email — the logs redact them automatically (NS-SEC-105).

What to do next

Once Nivoda credentials are saved and the connection test passes, the natural next step is your first catalogue sync. Head to First sync to kick it off and learn what to expect.