Security

API key

A secret that lets another system call an application's API.

An API key is a secret string that another system sends to prove it may use an application's API. Good practice is to give each key only the access it needs and an expiry date. In Vintage People keys are read-only unless you choose read and write, expire after 12 months by default, can be limited to set network addresses, and are shown only once.

Related terms

Webhook Single sign-on (SSO)

Help & how-to

See it in practice

Single sign-on and SCIM

Verify your domain, connect OIDC or SAML, provision users.

Data protection under the NDPA

The privacy console tabs and the breach clock.

Roles & access control

A two-stage model: what each role can see, and what it can do.

Browse the Help Center

See it applied to real payroll

Vintage People applies these statutory rules on every run, with a full audit trail.

See Vintage Payroll PAYE calculator