> ## Documentation Index
> Fetch the complete documentation index at: https://docs.shorpay.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication and API keys

> Create, scope, rotate, and revoke credentials for the Shor public API.

The public API is available to enabled employer workspaces. Ask Shor to enable your workspace before connecting an integration. Administrators create credentials in **Settings → API keys**. Copy the secret when it is shown; it cannot be retrieved later. Choose only the scopes the integration needs and an expiry date. Rotate before expiry, update your secret store, then revoke the old credential. Never put keys in browser code or source control.

Use the API base URL supplied for your environment. All resource paths start with `/v1`. Test credentials are accepted only by the matching test environment. The current contract is available without authentication at `/v1/openapi.json`; a [downloadable reference](/api-reference/openapi.json) is included here.

Connecting an AI assistant instead? Start with [Connect AI assistants](/employer/ai-assistants). The [MCP tool reference](/developers/mcp) maps every supported tool to its HTTP route, inputs, scopes, and confirmation requirements.

```bash theme={null}
curl "$SHOR_API_URL/v1/business" \
  -H "Authorization: Bearer $SHOR_API_KEY"
```

Keys act as the membership that created them. Leaving the workspace revokes access permanently. A role change applies immediately, including to retries. Admins can manage keys; members can read and create drafts when granted the corresponding scopes; viewers can only read. Timesheet and milestone approvals and rejections require an admin and the corresponding write scope.

| Scope | Operations |
| - | - |
| `read` | Business, contracts, timesheets, milestones, payments and balances |
| `contracts:write` | Initialize a contract draft |
| `timesheets:write` | Approve or reject a submitted timesheet |
| `milestones:write` | Approve or reject a submitted milestone |

## Next steps

* [Public API overview](/developers/public-api)
* [Rate limits](/developers/rate-limits)
* [Errors](/developers/errors)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.