Authentication

Every request carries an API key as a bearer token:

Authorization: Bearer plm_live_<id>_<secret>

The key is the tenant

A Payloom key belongs to one organization, and it identifies both the caller and the tenant. That is why no endpoint takes an organization parameter: the key already says which organization you are acting on. There is no way for one key to reach another organization’s data.

The secret is shown once

When a key is minted, the secret half is displayed a single time. Store it somewhere safe. If it is lost, mint a new key and delete the old one, keys cannot be recovered.

Keys carry scoped permissions

A key holds a subset of the permissions of the member who minted it, drawn from the same catalog the console uses:

• employees.read, employees.manage
• payruns.read, payruns.run

A call that needs a permission the key does not hold is refused. Approving and marking a run paid are deliberately not grantable to a key, because those move money and are recorded against a named person.

Environments

Environment	Base URL	Key prefix
Production	https://api.usepayloom.com/api/v1	plm_live_
Staging	https://staging-api.usepayloom.com/api/v1	plm_test_

A production key never works against staging, or the other way around: the prefix and the environment must match.