API Keys

API keys are the credentials that let scripts, automations and integrations call the BusinessHRM REST API on your behalf. Each key is a long secret token that you send with every request. This article explains how to create a key, choose what it can access, and rotate or revoke it.

Where to find it›API Keys

Permission: Only App Administrators can open the API Keys page and manage keys. Every key you create acts as you — it is tied to your user account and is limited to the workspace you are currently in and the data your account can see.

Creating an API key

Go to Settings → API Keys.
Click Create API Key.
Enter a Name that describes where the key will be used (for example Zapier integration or Reporting script). This is just a label to help you recognise the key later.
Choose the access level (see below).
Choose when the key Expires — Never, or On date to set a specific expiry date.
Click Create API Key.
Copy the key immediately. It is shown only once, in a popup, with a copy button and a ready-to-run curl example. Once you close the dialog you can never see the full key again.

Important: The full key value is displayed only at creation time. BusinessHRM stores only a hashed version, so it cannot show it to you again. If you lose it, rotate the key (below) to get a new one.

Full access vs specific permissions

When creating a key you choose one of two access levels:

Access level	What it can do
Full access	The key can call every API endpoint your account has access to. Best for trusted internal tools where you want one key for everything.
Specific permissions	The key is limited to only the resource groups you tick. Best for third-party integrations — grant only what they need.

When you choose Specific permissions, a grouped checklist appears. Tick the resource groups the key should be allowed to use. A search box and a Select all / Deselect all link help you pick quickly. The available groups are:

Group	Resources covered
Contacts	Contacts & categories
Leads	Leads & pipeline
Projects & Tasks	Projects, Tasks, Time logs
Finance	Invoices, Estimates, Expenses, Products, Currencies
Team & HR	Employees, Attendance, Leaves, Holidays, Departments, Designations
Support	Tickets
Workspace	Notices, Events, Contracts, Dashboard

Note: Granting a parent resource also covers its sub-resources. For example, granting Contacts also allows the contact-category endpoints. If you select Specific permissions but tick nothing, the key falls back to Full access.

The API Keys list shows each key's scope as a green Full access badge or one badge per granted resource.

Using the key

Send the key in the Authorization header of every request as a Bearer token:

Authorization: Bearer YOUR_API_KEY

For example:

curl https://app.businesshrm.com/api/v1/contact \
  -H "Authorization: Bearer YOUR_API_KEY"

If a key is scoped to specific permissions and you call an endpoint it is not allowed to use, the request is rejected. See REST API Basics for more on authentication and errors.

Managing existing keys

The API Keys table lists every key you have created, showing its Name, Permissions, Expiry, and when it was Last used.

Rotate (regenerate) a key

Use Rotate when a key may have been exposed, or on a regular schedule for security.

Find the key in the list and click Rotate.
Confirm in the dialog.
A brand-new key value is issued with the same name, permissions and expiry, and the old value stops working immediately. Copy the new value — like creation, it is shown only once.

Important: Rotating instantly invalidates the previous key. Update every integration that used the old value, or it will start failing.

Delete (revoke) a key

Find the key in the list and click Delete.
Confirm in the dialog.
The key is permanently removed and can no longer authenticate any request.

Expiry

A key set to expire On date stops working at the end of that day (in your company timezone). Expired keys are flagged with an Expired badge in the list. Keys set to Never stay valid until you rotate or delete them.

Security tips

Tip: Treat API keys like passwords. Never commit them to source control, paste them into public chats, or share them in screenshots.

Create a separate key per integration so you can revoke one without breaking the others.
Prefer Specific permissions over Full access for third-party tools.
Set an expiry date for short-lived or experimental keys.
Rotate keys periodically and whenever someone who knew a key leaves.