X-Api-Key request header.
Getting your API key
- Sign in to your Everhour account.
- Go to your profile page.
- Scroll to the bottom — your API key is shown there.
Using the API key
Include the key in every request:You can also pass the key as an
api_key query parameter (for example, ?api_key=YOUR_API_KEY). The X-Api-Key header is recommended — query strings can be recorded in server logs and browser history.What happens without a valid key
If theX-Api-Key header is missing or the key is invalid, the API returns:
Security recommendations
- Store the API key in environment variables, not in source code.
- Rotate the key if you suspect it has been compromised — you can regenerate it from your profile page.
- Each API key is tied to a specific user account and inherits that user’s permissions.
Everhour issues one API key per user account. For apps that act on behalf of other users, use OAuth 2.1 instead of sharing a key. Fine-grained scopes aren’t available with either method — access follows the user’s role.
