Authentication

Every request carries an API key as a bearer token:

Authorization: Bearer clm_live_<id>_<secret>

The key is the tenant

A Payloom key belongs to one organization, and it identifies both the caller and the tenant. That is why no endpoint takes an organization parameter: the key already says which organization you are acting on. There is no way for one key to reach another organization’s data.

The secret is shown once

When a key is minted, the secret half is displayed a single time. Store it somewhere safe. If it is lost, mint a new key and revoke the old one: keys cannot be recovered.

Keys carry scoped permissions

A key holds a subset of the permissions of the member who minted it, drawn from the same catalog the console uses. These are the ones the API reads:

Scope	What it opens
employees.read	Employees, departments, positions and locations, contractor agreements
employees.manage	Adding, changing, archiving and restoring employees
salary.read	Pay history, a contractor’s rate, company deductions
org.configure	Creating and renaming departments, positions and locations
payruns.read	Pay runs, payslips, one-off earnings, payment batches, balances, remittances, invoices, expense claims, retro
payruns.run	Creating and calculating runs, one-off earnings, deductions, recording remittances
payruns.files	The GL journal and statutory filings
payslips.send	Emailing a paid run’s payslips
leave.manage	Leave types, requests, balances and holidays
funding.manage	The ledger of the balance held at Payloom

A call that needs a permission the key does not hold is refused with 403 insufficient_scope.

A key feeds and reads; people decide. Whatever a key holds, no endpoint approves, reopens or pays a run, approves leave, an invoice or an expense claim, or moves money. Each of those is recorded against a named person, so they stay in the console.

Environments

Environment	Base URL	Key prefix
Production	https://api.usepayloom.com/api/v1	clm_live_
Sandbox	https://sandbox-api.usepayloom.com/api/v1	clm_test_

A live key never works in the sandbox, and a test key never works in production: the prefix and the environment must match. Keys issued before October 2026 begin plm_live_ or plm_test_ instead and keep working.