Name: TempClock
Author: TempClock

Bearer Token Authentication

All API requests must include an Authorization header with a Bearer token. Your API key will be provided to you by TempClock.

Authorization: Bearer tc_live_a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2

Note: The header is case-insensitive (Bearer or bearer both work), but the API key itself is case-sensitive.

API Key Format

TempClock API keys follow a consistent format that makes them easy to identify:

tc_live_a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2

tc_live_	Fixed prefix identifying this as a TempClock live API key
40 hex chars	Randomly generated hexadecimal string unique to your key

Total key length: 48 characters (8-character prefix + 40-character hex string).

Where to Get API Keys

API keys are created and issued by TempClock. To get an API key for your account, contact TempClock and we will generate one for you.

1

Contact TempClock

Get in touch to request API access for your account. Let us know what integrations you are planning so we can set up the right access.

2

Receive your API key

We will enable API access for your account and provide you with a securely generated API key. Each key is named for easy identification (e.g. "Payroll Integration").

3

Store it securely

Your API key will only be shown once when it is created. Store it in a secure location such as a password manager or secrets vault. Never commit it to version control or share it publicly.

4

View your keys

Once issued, you can view your active API keys and their status in your manage portal under Settings > API Keys. To request new keys or revoke existing ones, contact TempClock.

Example Request

Here is a complete example of an authenticated request using cURL:

curl -X GET \
  "https://tempclock.com/api/v1/workers.php?active=1&limit=10" \
  -H "Authorization: Bearer tc_live_a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2" \
  -H "Content-Type: application/json"
                

If the key is valid, you will receive a 200 OK response with JSON data. If authentication fails, you will receive a 401 Unauthorized error.

Successful response:

{
  "data": [
    {
      "id": 142,
      "first_name": "Sarah",
      "last_name": "Mitchell",
      "active": true
    }
  ],
  "pagination": { "total": 87, "limit": 10, "offset": 0, "has_more": true }
}
                    

Failed authentication response:

{
  "error": true,
  "message": "Invalid API key.",
  "status": 401
}
                    

Scopes

Scopes let you restrict what an API key can access. When you create a key, you can assign specific scopes to limit its permissions. If no scopes are assigned, the key has full access to all endpoints.

Scope	Access
workers:read	List and retrieve worker details
timesheets:read	List time entries and timesheet data
locations:read	List and retrieve location details
clock:write	Clock workers in and out
shifts:read	List and retrieve shift data
shifts:write	Create and modify shifts
departments:read	List departments
cost-codes:read	List cost codes
( empty )	Full access to all endpoints — no restrictions

Principle of least privilege: We recommend assigning only the scopes your integration needs. For example, a payroll export integration should use timesheets:read and workers:read rather than full access.

If a key attempts to access an endpoint outside its allowed scopes, the API returns a 403 Forbidden response:

{
  "error": true,
  "message": "Insufficient permissions. This key does not have the 'clock:write' scope.",
  "status": 403
}
                

Key Security Best Practices

Your API key provides access to sensitive workforce data. Treat it like a password and follow these security practices:

Never commit keys to version control

Do not hard-code API keys in your source code or commit them to Git repositories. Even private repositories can be compromised. Add your key file to .gitignore.

Use environment variables

Store your API key in an environment variable and reference it in your code:

# Set the environment variable
export TEMPCLOCK_API_KEY="tc_live_a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2"

# Use it in your requests
curl -H "Authorization: Bearer $TEMPCLOCK_API_KEY" \
  "https://tempclock.com/api/v1/locations.php"
                                

Rotate keys regularly

If you suspect a key has been compromised, contact TempClock immediately to have it revoked and a replacement issued. Keys can be set with expiry dates for additional security.

Restrict scopes

Create separate keys for different integrations, each with only the scopes it needs. A read-only reporting tool should not have clock:write access.

Use separate keys per environment

Use different API keys for development, staging, and production. This limits exposure if a non-production key is leaked, and makes it easier to track usage per environment.

CORS

The API supports Cross-Origin Resource Sharing (CORS) with a wildcard origin (Access-Control-Allow-Origin: *). This means you can call the API from browser-based applications.

Warning: Never expose your API key in client-side JavaScript that runs in users' browsers. Use a server-side proxy to keep your key secure.

Authentication