How Wild Apricot credential connections work
Both the Wild Apricot API import and the Wild Apricot WebDAV file pull ask you to hand MapleGather a Wild Apricot credential — an OAuth authorization, an API key, or a full-admin username and password. This page explains what happens to that credential and why it’s safe to enter.
The short version
Section titled “The short version”MapleGather stores your Wild Apricot credential encrypted, uses it only to pull your data, never shows it back to you or anyone else, and deletes it as soon as you disconnect or your migration finishes.
How it works
Section titled “How it works”When you enter a Wild Apricot credential, MapleGather checks it against Wild Apricot right away. If it’s valid, MapleGather stores it encrypted and shows you a Connected status with your site address and when it was last checked — never the credential itself. From that point on, every screen that shows this connection displays status and metadata only; the field where you originally typed the credential is write-only, so it’s never populated again, even if you come back to the same screen later.
If the credential is invalid, nothing is stored at all — there’s no in-between “half-connected” state left behind for you to clean up.
While connected, MapleGather uses the credential only to pull the Wild Apricot data you specifically ask for (contacts, events, payments, or files, depending on which connection you’re using). It’s never shared, logged, or used for anything else.
When you’re done — or when you explicitly disconnect — MapleGather deletes the stored credential. This happens whether you disconnect manually or reach the end of your migration.
Why it works this way
Section titled “Why it works this way”Your Wild Apricot credential could, in the wrong hands, expose your entire membership database. Treating it as write-only and deleting it once it’s served its purpose means there’s nothing sensitive left sitting in MapleGather after your migration is done — even if you forget to disconnect it yourself, it’s only ever used for the specific pull you started.
Edge cases & boundaries
Section titled “Edge cases & boundaries”- If Wild Apricot rejects your credential (for example, after you rotate a password or API key), MapleGather shows a Connection needs attention status and asks you to reconnect — it never silently keeps trying with a stale credential.
- Reading a connection’s status, or disconnecting it, works with either the API or the file-storage permission — you don’t need both permissions just to check on or remove a connection someone else set up.