Data & Export·Support CodeGEN-044 For Admins & HR Staff

Handling API Keys Securely

How WorkVell API keys are issued, and how to handle them safely.

【Issuing and revoking API keys】

API keys cannot be issued or revoked from the admin console.

Contact support to request issuance or revocation (see #GEN-008).

【Restrictions that can be applied to a key】

The following can be set when a key is issued — tell support what you need.

· Scopes (which data the key may access)

· An allowlist of source IP addresses

· A per-minute request limit (rate limit)

· An expiry date

【Handling keys safely】

(1) Least privilege

· Request only the scopes you actually need

· If your source addresses are fixed, ask for an IP allowlist as well

(2) Set an expiry

· Avoid keys without an expiry date, and rotate them regularly

(3) Store securely

· Never hardcode a key in source code

· Store it in environment variables or a secret manager

(4) Revoke keys you no longer need

· Contact support to revoke a key once you have finished using it

【If a key may have been leaked】

Contact support immediately so the key can be revoked.

Also review the operation log for suspicious access (see #GEN-197).

【About webhooks】

WorkVell does not send events to external URLs, so there is no webhook signature to verify (see #ENG-027).

managingapikeysintegrationsecuritybest

Was this article helpful?

More in this category

Managing My Number (Individual Number) Data

Collect, store, use, and dispose of employees' My Number data securely in compliance with the Act on Use of Numbers.

Responding to Personal Data Access/Correction/Deletion Requests

Handle employee or ex-employee requests to access, correct, or delete their personal data.

Data Retention and Deletion Policy

Understand how long WorkVell retains different types of data and when it can be deleted.

How to Export CSV and Practical Use Cases

Export attendance, payroll, and employee data as CSV and use it for analysis, reporting, or integration with other tools.