Creating API keys for external systems

Creating API keys for external systems

With API keys, external systems — such as your POS system, a BI tool, or your own script — can access Shiftdesk data. Each key receives precisely defined scopes, so you can keep access as narrow as possible.

Creating a new API key

1. Go to Settings → API keys.
2. Click Add API key.
3. Enter a name (e.g. "POS Cologne branch").
4. Choose the required scopes:
   • employees:read — read employee data
   • shifts:read / shifts:write — read/write shifts
   • time-entries:read — read clock-ins
   • absences:read — read absences
5. Click Create.

Important: shown only once

The full key (sk_live_...) is shown only once — right after creation. Copy it immediately into a secure password manager. After that, the dashboard only shows the last 4 characters for identification.

If you lose the key, you have to create a new one — Shiftdesk cannot recover it.

Sample request

The API base URL is https://api.shiftdesk.app/v1. Authentication is done via the Authorization header:

curl -H "Authorization: Bearer sk_live_xxxxxxxxxxxxxxxxxxxxxxxx" \
     -H "Content-Type: application/json" \
     https://api.shiftdesk.app/v1/employees

Rotation and revocation

For security reasons, you should rotate API keys at least once a year:

1. Create a new key with identical scopes.
2. Store it in the target system.
3. Verify that everything works.
4. Revoke the old key via the trash icon in the list.

Revoked keys become invalid immediately — ongoing requests fail with 401 Unauthorized.

Audit log

Every API access is logged with a timestamp, IP, and endpoint in the audit log. You'll find the logs under Settings → Security → API activity.

Rate limits

Shiftdesk throttles to 120 requests/minute per key. If you need more, contact support.