FairCheck HR in your Pocket
Check a payslip
How it works Pay calculator Pay guides For bookkeepers Pricing
Log in Book a demo

API Tokens

API tokens are the bearer credentials for the FairCheck API — "Bearer tokens for the FairCheck API. Treat them like passwords." Tokens belong to you, not to an account: a token identifies the user who created it and inherits that user's account memberships. Open the page from API in the settings navigation.

The list shows each token's Name, when it was Last used, and when it was Created, with a View button. If you have none it reads "You don't have any API tokens."

Create an API token

Click Create an API Token, give it a Name and save. The next page shows the token once: "Copy your API token now — it is shown only once and cannot be retrieved later." Use the copy button, then click Done.

Tokens are stored as one-way hashes. The full value exists only at the moment it is created, so FairCheck can never display it again; afterwards the token's page identifies it by its first 8 characters followed by "…", with the note "Full token was shown once at creation." If you lose a token, revoke it and create a new one.

Signing in through POST /api/v1/auth also returns a token — a fresh one on each login, while earlier tokens keep working until revoked.

Authenticate using Header

Send the token in the Authorization header on every request. The token's page shows the example:

GET /api/v1/me.json
Accept: application/json
Authorization: Bearer <YOUR_TOKEN>

and the equivalent curl:

curl https://<your-host>/api/v1/me.json
-H "Accept: application/json"
-H "Authorization: Bearer <YOUR_TOKEN>"

Requests without a valid token receive 401 Unauthorized. When you belong to several accounts, add an X-Account-Id header (or an account_id parameter) to pick one; an id for an account you are not a member of is ignored. The full reference, including the response envelope and async evaluation model, is at /developers and /developers/authentication.

Last used and revoking

Every successful API call stamps the token's Last used time, shown on the list and on the token's page ("—" if it has never been used). Tokens are listed most recently used first.

On a token's page:

  • Edit changes its name.
  • Revoke deletes it after "Are you sure you want to revoke this API token?". Requests with that token stop working immediately, and the page confirms "Your API token has been revoked".

A token grants the same API access as you have, so keep it in a secret manager, never commit it, and revoke it straight away if it leaks.