API Keys

Use this topic for manage legacy server credentials.

Before you start

  • Use the correct company and an active account with permission for this workflow.

Where to go

Integrations → API Keys

Audience

Business owners and active company admins responsible for legacy credentials.

Permissions

  • Company owners and active company admins may create or revoke legacy API keys.
  • Treat every API key as a server-side secret; never place it in browser code, mobile apps, source control, logs, or callback payloads.
  • The raw API key is revealed once after creation. Store it immediately in a server-side secret manager; if it is lost or exposed, revoke it and create a replacement.

Actions

Create API key
Use Create API key to support manage legacy server credentials.
Revoke API key
Use Revoke API key to support manage legacy server credentials.

Statuses

Active
The record is currently active.
Revoked
The record is currently revoked.

Workflow

  1. Open API Keys to inspect legacy credentials as the company owner or an active company admin.
  2. No supported API-key operation is currently verified. The retired shifts, attendance, safety alerts and maintenance endpoints cannot be used for setup.
  3. If you create a credential for legacy management, copy its reveal-once value into a server-side secret manager, then close the reveal dialog.
  4. Revoke an exposed or unneeded key. Creating a credential does not establish a working integration.

Expected outcome

Legacy API keys — no supported operation available. Lists show credential metadata; creation does not prove connectivity. Revoke exposed or unused keys.

Troubleshooting

An API request returns 401 Unauthorized
Sign in again for credential management. No supported operational API-key consumer is verified.
An API request returns 403 Forbidden
Credential management requires the company owner or an active company admin. Operational API-key endpoints are unavailable.
An API key appears in source control, logs, browser code, or a callback payload
Revoke the exposed key immediately, remove the leaked value, create a replacement, and store it only on the server