3 min·Updated May 1, 2026
Generating an API key
Settings → API keys. Scope per key. Rotate every 90 days recommended.
Read
Build against ADP. SDKs, webhooks, OAuth.
Settings → API keys. Scope per key. Rotate every 90 days recommended.
HMAC-SHA256 of body + timestamp. Reject if delta >5 min. Code samples in 4 languages.
For user-context apps. Code challenge, code verifier, refresh tokens.
Per-plan limits. RateLimit-* headers (IETF httpapi draft) + 429 with Retry-After per RFC 6585.
Article you need isn't here? Email support — we reply in under 30 minutes during business hours.