Access Control & API Keys

The Access Control section lets administrators manage API keys for machine-to-machine integrations and review permission settings. Navigate to Dashboard -> Access.

API Keys

API keys allow external systems (e.g., payroll providers, BI tools, custom scripts) to securely access WoPora data without using a user's credentials.

Creating an API Key

1. Go to Dashboard -> Access -> API Keys
2. Click New API Key
3. Enter a name for the key (e.g., "Xero Integration", "BI Dashboard")
4. Set the permissions scope (read, write, or admin per data type)
5. Optionally set an expiry date
6. Click Generate Key
7. Copy the key immediately --- it is shown only once

Security: API keys are hashed after creation. WoPora cannot retrieve or display a key after the initial generation. Store keys in a secrets manager.

API Key Scopes

Rotating an API Key

1. Find the key in the API Keys list
2. Click Rotate
3. A new key value is generated --- copy and update it in your integration
4. The old key is immediately revoked

Revoking an API Key

1. Find the key in the list
2. Click Revoke and confirm

Role Permissions Overview

Security Best Practices

• Use the minimum scope --- Grant only the permissions each key needs
• Set expiry dates --- Rotate at least quarterly
• Audit regularly --- Deactivate any keys no longer in use
• Use separate keys per integration --- Never share one key across multiple systems

Related Docs

• Users & Roles
• Settings