Skip to main content
Every request carries an API key. Requests that touch one customer’s data carry a connector token as well.

​
Where to find them

API key - Settings → API Key. Each environment has its own, and a development key does not work against production data - see Environments. Regenerating a key invalidates the old value immediately. Connector token - it exists once the end user has authorized the connection. Where you read it depends on how they connected - see How to connect.
  • Embedded Link - onSuccess hands your frontend a short-lived temporary_token, which cannot read data. Swap it from your backend with the token exchange.
  • Magic Link - there is no temporary token. Look the connector up by the origin_id you set, with Get Connectors.
  • Any route - the connector’s Connector Details panel in the dashboard, for a one-off lookup.
A connector token is scoped to one API category. An HRIS token used against /api/ats/v1/* returns 403 even though both credentials are valid.

​
Which endpoints need the connector token

The API key is required everywhere. The connector token is required only where the request names a customer. category is hris, ats or lms. Sending a connector token where it is not used is harmless; omitting it where it is required returns an error rather than an empty result.

​
A third header on writes

Four HRIS write endpoints also take X-Idempotency-Key - POST /employees, /employee-payroll-runs, /time-off and /timesheet-entry.
Passthrough does not accept it. For how to choose a key, what a replay returns and how to handle a 409, see Idempotency.

​
Auth errors

A 200 with no records is not an auth problem - the connector has no synced data yet. See Sync status.