bamboohr-security-basics

# BambooHR Security Basics ## Overview Security best practices for BambooHR API integrations covering API key management, webhook HMAC verification, PII handling, and access control. BambooHR contains highly sensitive employee data (SSNs, salaries, addresses) — treat every integration as PII-critical. ## Prerequisites - BambooHR API access configured - Understanding of environment variables and secrets management - Access to BambooHR admin settings ## Instructions ### Step 1: API Key Security ```bash # .env (NEVER commit to git) BAMBOOHR_API_KEY=your-api-key BAMBOOHR_COMPANY_DOMAIN=yourcompany BAMBOOHR_WEBHOOK_SECRET=your-webhook-hmac-secret # .gitignore — MUST include these .env .env.local .env.*.local *.pem ``` **Key management rules:** - Each environment (dev/staging/prod) uses a separate API key - Create API keys under service accounts, not personal accounts - API keys inherit the permissions of the user who created them - Rotate keys quarterly; immediately rotate if exposed **Key rotation procedure:** ```bash # 1. Generate new key in BambooHR: Profile > API Keys > Add New Key # 2. Update secret store aws secretsmanager update-secret --secret-id bamboohr/api-key --secret-string "new-key" # Or for GCP: echo -n "new-key" | gcloud secrets versions add bamboohr-api-key --data-file=- # 3. Deploy with new key # 4. Verify new key works curl -s -o /dev/null -w "%{http_code}" \ -u "new-key:x" \ "https://api.bamboohr.com/api/gateway.php/${DOMAIN}/v1/employees/direct...