Skip to main content
All API requests must be authenticated. Everhour uses API key authentication — pass your key in the X-Api-Key request header.

Getting your API key

  1. Sign in to your Everhour account.
  2. Go to your profile page.
  3. Scroll to the bottom — your API key is shown there.

Using the API key

Include the key in every request:
You can also pass the key as an api_key query parameter (for example, ?api_key=YOUR_API_KEY). The X-Api-Key header is recommended — query strings can be recorded in server logs and browser history.
Example:

What happens without a valid key

If the X-Api-Key header is missing or the key is invalid, the API returns:

Security recommendations

  • Store the API key in environment variables, not in source code.
  • Rotate the key if you suspect it has been compromised — you can regenerate it from your profile page.
  • Each API key is tied to a specific user account and inherits that user’s permissions.
At this time, Everhour supports one API key per user account. OAuth or fine-grained scopes are not currently available.