Exchanges username, password, and application key for a persistent API key scoped to that user and application. No pre-existing authentication is required; credentials are passed in the request body. On success, returns a persistent API key, the authenticated user ID, the linked employee ID (null when no employee record is associated), and the base API URL to use for subsequent requests.
This endpoint is deprecated. New integrations should prefer OAuth or OpenID Connect instead.
applicationKey must correspond to a registered non-mobile application; iOS and Android app keys are explicitly rejected with a 403 (no body). The optional deviceId associates the generated key with a specific device.
Response format is determined by the Accept request header. Send Accept: application/json to receive JSON; omit the header or send any other value to receive XML. Alternatively, set ?format=json in the query string to force JSON regardless of the Accept header.
Note: If the company has SSO enabled and password login is disabled, this endpoint returns HTTP 200 with a plain-text error message rather than a structured error response.
| Time | Status | User Agent | |
|---|---|---|---|
Retrieving recent requests… | |||
This endpoint is designated for use by our Marketplace Partners only at this timeThe intended purpose of this endpoint is to assist with the integration of third party partners. To this end, the below mentioned, "Application Key" is not available for general use.
Sample Request
Headers:
Content-Type - application/x-www-form-urlencoded
Post Variables:
user - The user's email address.
password - The user's password.
applicationKey - The application key provided to you by BambooHR.
deviceId - Optional - An ID for the user's mobile device. This deviceId can be generated when the app is first installed on a device, and should be unique enough to prevent collisions between users within the same company.
Sample Response
Success:
{
"success":true,
"userId":1,
"employeeId":25,
"key":"e254c96d97a12dc561f56d8713e58ac6c2a8c166"
}
Fail:
{
"success":false,
}Success:
<auth>
<response>authenticated</response>
<userId>1</userId>
<employeeId>25</employeeId>
<key>e254c96d97a12dc561f56d8713e58ac6c2a8c166</key>
</auth>
Fail:
<auth>
<response>declined</response>
</auth>