How do I see who changed what with AI in weclapp? With personal API keys
You give your team AI access to weclapp. Two weeks later, the change history of an order shows a name, and it's always the same one.
The problem: one key for everyone
Not because one person did everything, but because everyone works through the same API key. weclapp attributes every change to the user who owns that key. “Jana changed the price” becomes “the integration user changed the price”, and the question “who was that?” can no longer be answered in the ERP itself.
That is not only a question of traceability but also of permissions: a shared key has exactly one permission level. Someone who should only read quotations technically gets the same reach as the head of purchasing. The restriction then happens somewhere outside weclapp instead of in weclapp.
The solution: every person with their own key
With wals.pro AI 4 weclapp, each team member stores their own weclapp API key, themselves and without a ticket. The account page has a section called “My ERP keys”: set, replace and test per tenant. Only an admin can remove a key, so that nobody quietly undermines the requirement to use a personal key.
From that moment on, the AI works under the weclapp user who owns the key. The history in the ERP shows real names again, and the native weclapp permissions of that user apply. The AI can't do more than the person is allowed to do themselves.
Three things were important to us here:
No key is stored unchecked. Every key is tested against exactly the weclapp system of your tenant before it is saved. A typo is caught in the form instead of surfacing in the next AI session. If the test fails, nothing is saved.
You never see the key again, and we don't show it anywhere. The account page shows you whether a key is stored, which weclapp user it belongs to, when it was last checked successfully and when it was last used. In addition there is a fingerprint as a short identifier for recognition, never the key itself. That is enough to tell whether you've got the right one.
You can make personal keys mandatory. The tenant profile has a switch: “Require personal weclapp key”. When it's on, nobody connects through the shared key any more, and there is no silent fallback. Anyone who hasn't stored their own key gets a clear message with the path to the account page instead of a cryptic error.
What you get out of it
The change history in weclapp becomes meaningful again. When there's a question, internally, from your tax advisor or during an audit, it shows who initiated the change, and not the name of a technical user.
Permissions are assigned where you already maintain them anyway: in weclapp. You don't have to keep two separate permission systems in sync.
And offboarding is short: deactivate the weclapp user, done. A note on this is also in the dialog: removing the key on our side does not revoke any weclapp permission. It only ends our platform's use of it. The actual revocation is and remains a task in your weclapp administration. We'd rather say this clearly than have anyone feel falsely secure.
What you need to do
Nothing, if everything should stay as it is. The shared tenant key continues to work unchanged.
If you want to switch: each person creates an API key in weclapp for their own user and enters it under “My ERP keys”. Once everyone has switched, an admin turns on the requirement in the tenant profile. How to connect weclapp is explained in the help article Connect weclapp, and what admins can configure for the team in the help article Team.
What it is not
Personal keys are available in every paid plan, not in the free one. They don't replace weclapp administration: you still grant and revoke permissions in weclapp.
You can find what else wals.pro AI 4 weclapp can do on the product page and in the overview of the weclapp MCP server. Connect wals.pro AI to your weclapp at ai.wals.pro or book an appointment at wals.pro/termin.