Only a company admin can see or manage API keys — see understanding different user roles in Asanify for what separates a company admin from an HR admin. If your account is set up as an HR admin, the API access card always shows Available on request, whether or not your company has switched on partner API access, and opening the page directly tells you to have a company admin create or revoke a key for you instead.

Click Integrations in the left navigation — the same tab where you connect Asanify to your company's Slack workspace — then look for the API access card. The card shows how many active keys you have, or Not set up yet if you haven't created one. If your company doesn't have partner API access switched on yet, the card shows Available on request; click Contact us on the card to ask Asanify to switch it on.

Click Manage API keys to open the page.

The page lists every key your company has created, with its name, a masked key prefix, the data it can Access, when it was last used, and its status. Revoked keys stay in the list, struck through, so you keep a record of what existed.

On the right, the Connection details panel gives you the base URL, the auth header format, the rate limit and the page size to use when calling the API, each with a copy button. Below it, the More access panel lists data that isn't switched on for your company yet, such as pay lines, salary structures, contractor payments, custom fields and bank accounts; click Request access there if your integration needs one of those (see Step 10).

A warning banner reminds you that anyone holding a key can reach everything on its access list, from any machine, so treat a key like a password and use one key per system.

Click Create API key at the top of the page, or the same button in the empty state if you have no keys yet. Your company can hold a limited number of active keys at once; if you've reached that limit, Create API key is disabled and a banner tells you to revoke one you no longer need first.

Give the key a name, ideally the system that will use it, for example "MS Dynamics production". You'll be asked to type this name back if you ever revoke the key, so a clear name matters. Click Continue.

Tick everything the key needs to access, from People, Legal entities, Org masters, Payroll runs, Leave balances, Pay lines and Bank accounts, depending on which are switched on for your company. Tick only what the system actually needs, since anything ticked here leaves your company whenever the key is used.

Anything your company hasn't switched on yet appears below, greyed out, under Not switched on for your company. Click Request access next to one to ask Asanify to enable it (see Step 10).

Click Create key once you've ticked at least one scope.

Asanify shows you the key's plaintext value exactly once. Click the copy icon next to it, or select and copy it by hand. Asanify stores only a one-way hash of the key, so if you lose this value you'll need to create a new one; nobody, including Asanify, can retrieve it again.

Below the key, a ready-made curl command lets you check it works, built from one of the things you just gave it access to. Once you've confirmed it works, see authentication and your first call for how to send the key on every request your integration makes. Tick I have saved this key somewhere safe before clicking Done — Asanify won't let you move on until you do.

Click a key's name, or its View details icon, to open its details drawer. It shows the masked key, when it was created and by whom (when that's known), when it was last used, what it can access, and the last 20 requests made with it, each with its method, path and status code, so you can tell whether a system is actually using it.

Click a key's Replace key icon to retire it without breaking whatever is using it right now. Asanify immediately creates a new key with the same access and the same name plus a suffix, and shows you its one-time secret the same way Step 5 does; copy it and tick that you've saved it.

Both the old and new key keep working from this point. Nothing expires automatically, so there's no deadline pressure while you update the system that was using the old key.

Once you've updated your system with the new key, tick Update your system with [key name]. The old key's last-used time sits right next to the revoke action; refresh it to confirm nothing is calling Asanify with the old key anymore before you revoke it.

Click Revoke the old key, which opens the same confirmation described in Step 9.

If you leave a replacement unfinished and come back later, even after reloading the page, Asanify shows a banner reminding you to finish it, with a Finish the replacement button that reopens this checklist.

Click a key's Revoke icon to retire it without replacing it. If the key was used within the last 24 hours, Asanify warns you that something is likely calling it right now.

Type the key's name to enable Revoke key (capitalization doesn't matter, but the letters have to match). Revoking takes effect immediately and can't be undone; whatever was using that key starts failing right away.

Some data, such as pay lines, salary structures, contractor payments, custom fields and bank accounts, is switched on per company rather than by default. Click Request access from the More access panel on the API access page, or Request access next to a locked item while creating a key.

Adjust what you're asking for using the chips, and describe what your integration needs the data for; the more specific this is, the faster Asanify can review it. Click Send request. Asanify doesn't grant anything automatically: an admin reviews the request and switches the access on for your company. Until they do, the More access panel and any locked rows you asked about show Request pending instead of the request button, so you don't need to send it again.