API keys, webhooks and calendar feeds

Any staff member can create a personal calendar link from My shifts and subscribe to it in Apple Calendar, Google Calendar or Outlook. It shows only their own shifts and can be revoked and reissued at any time.

An API key authenticates your organisation and can only ever read your organisation — there is no parameter on any endpoint that names a tenant, so a key cannot be pointed anywhere else even by mistake.

The key is shown once when it is created. We keep a fingerprint of it, not the key, so it cannot be looked up again — if it is lost, revoke it and mint another.