Skip to main content
API keys are managed in the JobHandy administration portal. This page explains who can manage credentials, how scope is assigned, and how access is revoked or restored.
Open JobHandy Administration. API key management requires at least one of these portal permissions: IT, HR, or Company-Admin.

​
Permission models

Portal permissions and API-key scope are separate controls: A user who may create a key does not automatically grant that key access to every company. The scope selected during creation is the effective API boundary.

​
Open API key management

In the administration portal, open IT Settings and select the API Keys tab. The table shows each key’s name, scope, status, creation date, and available actions.
JobHandy IT Settings with the API Keys tab, existing API keys, and the Create API Key button

​
Create an API key

Click Create API Key and enter a descriptive name for the consuming system or integration. Recommended naming pattern:
Next, define the companies and divisions the key may access.
Create API Key dialog showing the key name and scope selection

​
Understand scope selection

In the illustrated example, Select all applies the key to the complete company structure of the selected organization.
Use the narrowest scope required. Create separate keys for systems with different responsibilities, companies, or operational owners.
Click Add to apply the selected scope and then Save to create the key.

​
Copy and store the generated key

JobHandy displays the complete credential immediately after creation. The key is active and can be used in the X-API-Key request header.
Confirmation after creating a JobHandy API key
Copy the key immediately and store it in a secret manager. Do not place API keys in source code, browser applications, public repositories, tickets, screenshots, or application logs.

​
Verify the active key

After closing the dialog, the key appears with status ACTIVE. The Deactivate action revokes the credential without deleting it.
Newly created JobHandy API key with ACTIVE status and the Deactivate action

​
Deactivate, reactivate, or delete

Click Deactivate when access must be revoked. Deactivation takes effect for subsequent protected requests. After deactivation, the key is shown with status INACTIVE and can be reactivated or deleted.
Inactive JobHandy API key showing Reactivate and Delete actions

​
Rotate a key without downtime

Do not deactivate the old key until the replacement has completed a successful protected request in every active integration instance.

Detailed rotation procedure

Use the operational runbook for preparation, rollout, verification, rollback, and retirement.

​
API key lifecycle

For request headers and authentication failures, continue with Authentication.
Last modified on August 28, 2026