Each company you create has its own company API key, returned once when you create the company. These endpoints let you manage the company's API keys from then on: see them, add more, rotate them, and retire them. In embedded payroll, you control the API keys of the companies you create.
| Endpoint | What it does |
|---|---|
| List a company's API keys | Lists the keys, redacted |
| Create a company API key | Issues another key, shown once |
| Rotate a company API key | Issues a replacement, and retires the old key after a delay |
| Set a company API key's expiry | Schedules a key to stop working |
| Cancel a company API key's expiry | Keeps a key that was scheduled to stop |
Authentication
Like the rest of this section, these endpoints use your partner API key, not the company's. The company's keys are what you give to the integration that works inside the company, for example to manage its webhook endpoints or add workers. See Authentication & API tokens.
How keys are handled
- A key is shown once. The full key is in the response that creates it, which is create and rotate. Every other response shows it redacted, as
tsk_prod_2...and its last characters. Store each key as soon as you get it. - You control every key of the company, including keys that the company's own administrators created in the Everee admin portal. The list shows them all.
- Rotating keeps the label and settings, issues a new key, and lets the old one work for 0 to 24 more hours. Use the overlap to move your integration over without an outage.
- Expiry takes effect at the time given. After that, requests with the key get a
401.
Rotating a key
- Rotate the key, with enough
expireInHoursto deploy, and store the new key. - Switch your integration to the new key.
- After the old key expires, check with List a company's API keys that only the keys you expect remain.