Sign admins in from your product

If your product has a "Go to Payroll" button, Everee can take the company admin straight from your product to Everee. Your server asks Everee for a one-time link and opens it in the admin's browser. The admin skips the password step and lands on Everee's multi-factor challenge, enters the code from their authenticator app, and is signed in.

📘
Multi-factor authentication is never skipped
The link takes the admin past the password step only. The admin always completes the multi-factor challenge. A link together with a stolen secret still can't get an attacker past it.

Availability

Admin login links are available when all of these are true:

Everee has switched the feature on for the company. Ask Everee support to enable it.
The company is a Production company. Sandbox companies can't use it.
The admin can approve payments, has turned on multi-factor authentication, and has an authenticator app set up.
You call the API with the company's Production API token that has the integration:admin-login-links:write scope. Sandbox tokens and partner API keys are refused.

Each admin gives you their own secret

A link is created for one admin, identified by a secret that the admin gives to your integration. Give your admins a place in your product to enter it, and keep one secret per admin and company. A secret is shown to the admin once, so your integration must store it when it is entered.

A secret stops working, and the API answers 404, when:

The admin replaces it with a new one, or revokes it.
Everee locks the account for security, or the account is put into lockdown.
The admin changes or resets their password.
The admin removes or replaces their authenticator app.
Everee turns the feature off for the company.

A secret that has stopped working never starts working again. Ask the admin for a new one.

Create a link

When the admin clicks your button, send the admin's secret from your server with Create an admin login link:

curl -X POST https://api.everee.com/integration/v1/admin-login-links \
  -u "$EVEREE_COMPANY_API_TOKEN:" \
  -H "x-everee-tenant-id: $EVEREE_TENANT_ID" \
  -H "Content-Type: application/json" \
  -d '{"adminSecret": "<the admin'"'"'s secret>"}'

The response is 201:

{
  "url": "https://app.everee.com/login/link#token=<one-time token>",
  "expiresAt": "2026-11-12T23:35:00Z"
}

The url is complete. Open it in a new browser tab, or redirect the admin's browser to it. The link:

expires 60 seconds after it is returned (expiresAt),
works once, and
is replaced by any newer link for the same admin: only the newest link works.

Errors

Status	Meaning	What to do
`400`	`adminSecret` is missing.	Send the secret in the request body.
`403`	Not available. The `errorMessage` says why: the feature isn't enabled for the company, the token isn't a Production token or lacks the scope, or the admin's account is locked or their password has expired.	Fix what the message names. For a locked account or expired password, tell the admin to sign in to Everee the usual way.
`404`	The secret isn't valid: it is unknown, was replaced or revoked, or belongs to a different company.	Ask the admin to create a new secret.
`429`	Too many links requested. The limit is per admin secret and per API token, per minute.	Wait, then try again. Create a link only when the admin clicks the button.

Errors use the usual body, for example {"errorCode": "404", "errorMessage": "...", "path": "/integration/v1/admin-login-links"}. See Requests & responses.

Security guidance

Store the secret like a password. Encrypt it at rest, never write it to logs, and never send it to the browser.
The link is a sign-in credential. Don't log it, store it, or send it by email or chat.
Create a link only when the admin clicks the button. Don't create links ahead of time, and open the link as soon as you receive it.