Create and Manage API Keys

This article provides a comprehensive guide on setting up and managing API keys for BambooHR. It outlines the process of creating, organizing, and securing API keys to connect internal tools. Users with permissions, such as Account Owners and Full Admins, can manage keys based on their access levels. The article details how API keys function, emphasizing that they inherit the permissions of the user who created them. It includes steps for creating an API key, ensuring users understand the importance of naming and securely storing the key. Additionally, it covers managing API keys, including searching, enabling, disabling, and deleting keys. Related articles offer further insights into the BambooHR API.

  • Jul 8, 2026
  • Knowledge

Title
Create and Manage API Keys
Article Text
This feature is included in the Core, Pro, and Elite packages.

How do I set up and manage my API keys?

Summary

You can create, manage, and monitor API keys to connect your internal tools to BambooHR. This guide walks through how to set up a key and keep it organized and secure over time.

Expand AllCollapse All

Table of Contents

Who this is for

Users with permissions to create API keys:

  • Account Owners
  • Full Admins
  • Custom access level users
  • Manager access level users

The access allowed by each API key is based on the access level settings of the user who generated it.

How API keys work

Each API key is tied to the user who created it.

  • The key inherits that user's permissions.
  • It can only access the data that user can access.
  • It can be used to send and receive data through the API.
  • The user can manage multiple API keys.

Because of this, it is important to create keys using the appropriate access level.

Before you start

Make sure you have:

  • Access to your BambooHR account with permission to create API keys
  • A clear idea of what the key will be used for
  • The appropriate access level for the data you want to share

Create an API key

  1. After logging into your BambooHR account, click on your profile picture in the bottom left corner.
  2. Select API Keys (or My API Keys & Devices, depending on your account setup).

Tip: Use a descriptive name for the API key so you can easily identify it later.

  1. Click +New API Key.
  2. Enter a name for the API key (required).
  3. Click Create Key.

API keys have full user permissions and never expire. They are for your internal use only, as per the  BambooHR Developer Terms of Service. If a third party needs access, direct them to our Developer Portal or Partner Program.

After creating a key, copy and store the key securely. You will only see the API key code once. If you do not copy or have misplaced the key, you will need to create a new key.

Note: BambooHR cannot retrieve the key for you because it is encrypted within our system for security purposes.

Create a non-employee user for integrations
All (15)

If you want to limit access or separate integrations from employee accounts, you can create a non-employee user and add them to a custom access level.

  1. Go to Settings > Access Levels.
  2. Select an existing custom access level or create a new one with only the necessary permissions.
Integration Access (0)

Once the custom access level is created:

  1. Click the gear icon on the custom access level page.
  2. Select Add a New Non-Employee User.
  3. *Enter the user's details and save.
  4. Log in as the non-employee user and create an API key.

*Non-employee user email: If necessary, you can create an email alias for the integration to connect to your original email address. For example, your regular email address is pandabear@bamboohr.com, and you want to create a non-employee user with the same address, you can use an email alias such as pandabear+integration@bamboohr.com.

Not all email providers or security teams support this. Make sure to check with your company's experts before using an email alias.

Manage API keys

You can access API keys from two locations, depending on your access level:

  1. Company View (Account Owners & Full Admins only)
    • Settings > Account > API & App Access: Shows all API keys across your company (Account Owners and Full Admins only)
  2. Personal View (all users)
    • Profile photo > API Keys (or My API Keys & Devices): Shows only the keys you created

Both views include the same management capabilities, with slight differences in the information shown. In either view, you can manage your API keys in one place, including:

  • Search for keys
  • View key details such as name, status, and last used date
  • Enable or disable keys
  • Update key details, including the name and settings
  • Delete keys you no longer need
  • Select multiple keys to enable, disable, or delete

Depending on your access level, you may also see additional columns:

  • In the company view, you will see the owner of each API key.
  • In the personal view, you may see fields such as Application or Device ID.

Use the Last Used column to help identify keys that are no longer active so you can clean them up as needed.

You can also open an individual key to:

  1. Update its name
  2. Change its status (Enabled or Disabled)
  3. Adjust auto-disable settings
    • Keys marked as "Auto-Disable" will be automatically disabled after 90 days of not being used.
  4. Delete the key

When to disable or delete a key

  • Disable a key if you might use it again later.
  • Delete a key if you no longer need it.
URL Name
587919