Documentation

Authentication

Authenticate with client_id, client_secret, and api_key to receive a Bearer access token.

Third-party apps authenticate with client_id, client_secret, api_key, and scope.

grant_type must be oxhrmapi.

Token endpoint: POST https://panel.oxhrm.com/api/v1/oauth/token

Use the access_token as Authorization: Bearer <token> on /integrations routes.

API tokens can access the documented integration endpoints for the scopes granted on the API key.

Call the shared base URL — organization comes from the credentials, not from a company subdomain.

Endpoints

POST/api/v1/oauth/tokenPublic

Generate access token using API credentials

Send as application/x-www-form-urlencoded.
Create credentials in the OXHRM panel → Developer API.
Full URL: https://panel.oxhrm.com/api/v1/oauth/token

Request body

grant_type=oxhrmapi
scope=employees attendance leave departments expenses shifts holidays locations designations documents assets time-adjustments sales
client_id=<client_id>
client_secret=<client_secret>
api_key=<api_key>

Example response

{
  "access_token": "<jwt>",
  "expires_in": 86400,
  "token_type": "Bearer",
  "scope": "employees attendance leave departments expenses shifts holidays locations designations documents assets time-adjustments sales"
}