Authentication and keys
View as MarkdownEvery request needs an API key. A personal key works as its holder; a master key, for the business owner, works across the business.
Send your key
Put the key in the Authorization header as a bearer token. Tools built for Clockify can send it in X-Api-Key instead.
Authorization: Bearer pstt_live_••••••••••••••••••••••••••••••••••••••••
# or
X-Api-Key: pstt_live_••••••••••••••••••••••••••••••••••••••••Keys start with pstt_live_ followed by 40 letters, digits, - or _. Anything else is refused with 401 UNAUTHORIZED.
Get a key
- Sign in to PaySuiteTT and open Settings → API keys (staff and managers: in their own workspace's Settings).
- Name the key after where it will be used, such as "Claude on my laptop", and press Make a key.
- Copy it straight away: it's shown once. PaySuiteTT keeps only a fingerprint of it.
The PaySuiteTT team switches the API on for each business; until then, keys can't be made and requests return 403 API_OFF. Ask support@illusionxmedia.com. Each person can have up to 10 active keys, and can revoke their own at any time; owners and accountants can revoke anyone's.
Personal and master keys
| Personal key | Master key | |
|---|---|---|
| Who makes it | Any active member | The business owner only |
| Clients, projects, tasks | Find and add, as the tracker app does | |
| Timer | Start, change and stop the holder's own timer | |
| Time entries | The holder's own: add, correct and delete unapproved time | Anyone's: read, correct (approved time too) and delete unapproved time |
| Reports | All Staff time, read only, hours only | All Staff time, with amounts |
| Never | Change time that's in a pay run, or delete time with screenshots | |
A personal key acts as Staff whatever its holder's role, so it never reaches anyone else's entries. A master key stops working if its holder stops being the owner. Every change made with a key is in the business's audit log, and entries made through the API are marked with the source api.
Keep keys safe
- Give tools the key as an environment variable, such as
PAYSUITETT_API_KEY. - Never paste a key into a chat, an email or a file in a code repository.
- If a key may have been seen, revoke it on Settings → API keys and make a new one.