Authentication

Create a token

Sign in and open Settings → API tokens. You only see this if your role can use the API.
Name the token, choose when it expires, and tick what it may do. Select all ticks everything your role allows.
Copy the token when it is shown. It is shown once; if you lose it, revoke it and make another.

Send it on every request:

Authorization: Bearer YOUR_TOKEN

Revoke a token any time from the same page. Tokens also stop working when their owner is deactivated.

Who can create tokens

Creating tokens is a permission (Create API tokens) on a role. The owner then chooses, on that same role, exactly which scopes it covers. A role with the permission but no scopes can make tokens that do nothing, so no one gets the whole API by accident.

Scopes

Scope	Allows
`company:read`	See company settings
`company:update`	Change company settings
`locations:read`	See locations
`locations:create`	Create locations
`locations:update`	Change locations
`calendars:read`	See calendars
`calendars:create`	Create calendars
`calendars:update`	Change calendars
`people:read`	See people
`people:create`	Invite people
`people:update`	Change people
`people:delete`	Deactivate people
`activities:read`	See tasks
`activities:create`	Create tasks
`activities:update`	Change and move tasks
`activities:delete`	Delete tasks
`roles:read`	See roles
`history:read`	Read a day's history

Who am I

`GET /api/v1/me`

Needs no scope. Returns the token's owner, company, expiry and the scopes the token can use right now.

{
  "data": {
    "id": "0195f0a1-7c2e-7b3a-9d41-6f0a2c8e1b12",
    "name": "Dana Driver",
    "email": "[email protected]",
    "company": { "id": "0195f0a1-7c2e-7b3a-9d41-6f0a2c8e1b03", "name": "North Stores" },
    "token": { "name": "Payroll export", "expires_at": "2027-01-14T18:00:00+00:00" },
    "scopes": ["activities:read", "people:read"]
  }
}