Skip to main content
All API requests must be authenticated. Everhour supports two methods: an API key for your own scripts and server-to-server jobs, and OAuth 2.1 for apps that act on behalf of another user. This page covers the API key — pass it in the X-Api-Key request header.

Getting your API key

  1. Sign in to your Everhour account.
  2. Go to your profile page.
  3. Scroll to the bottom — your API key is shown there.

Using the API key

Include the key in every request:
You can also pass the key as an api_key query parameter (for example, ?api_key=YOUR_API_KEY). The X-Api-Key header is recommended — query strings can be recorded in server logs and browser history.
Example:

What happens without a valid key

If the X-Api-Key header is missing or the key is invalid, the API returns:

Security recommendations

  • Store the API key in environment variables, not in source code.
  • Rotate the key if you suspect it has been compromised — you can regenerate it from your profile page.
  • Each API key is tied to a specific user account and inherits that user’s permissions.
Everhour issues one API key per user account. For apps that act on behalf of other users, use OAuth 2.1 instead of sharing a key. Fine-grained scopes aren’t available with either method — access follows the user’s role.