Under API keys, create the key and tick the scopes (employees, payroll, departments, positions, timeclock, reports, in read or write). It is shown only once.
Creating the key
Under the API keys menu, click "New key", give it a name that identifies the integration (the ERP, the time clock, the BI) and tick the scopes. The available scopes are employees:read, employees:write, payroll:read, payroll:write, departments:read, departments:write, positions:read, positions:write, timeclock:read, timeclock:write and reports:read.
The key is shown a single time, on creation. Copy it into a secrets vault; if you lose it, revoke it and create another.
One key, one company
Each key belongs to one company and only sees its data. To integrate several companies of the same account, create a key in each one. GET /companies returns the key's company, which helps the integrator confirm where it is writing.
Good practice
Use one key per integration and only the scopes it needs: a BI that reads reports gets reports:read and nothing else. Revoke the key immediately if it leaks; revocation takes effect at once. Every creation and revocation is in the audit trail, and calls made with the key are logged for 90 days.