API tokens

Coming soon

API tokens are not available yet. The details of how they will work — how they are created, what they can do and how long they last — are still being decided, so don't build an integration that depends on them. This page will be updated when they are available.

API tokens are planned as a separate credential for each integration. The goal is that your systems can call the RushHour API without storing a person's password, with only the access that integration needs, and that a company can stop one integration's access without affecting anyone else.

What to do today

Authenticate by signing in as a Company Portal user, as described in Authentication. To keep that safe and easy to manage:

• Use a dedicated user for each integration, rather than a person's own account.
• Give that user only the roles the integration needs. Every request is checked against them — see Users, roles and permissions.
• Keep the password on your server, in a secrets manager or secure configuration.
• To cut off an integration, disable its user or set a new password for it. Tokens already issued to that user then stop working.