Before you start
The API allows an authorised integration to work with information in Talento. Every credential belongs to an active employee in the company: requests run with that person's permissions and within the same account.
This applies the same access control used in the application. It also makes the choice of identity, its permissions, and secure token storage part of the integration's security.
Warning
Treat an API token like a password. Never paste it into chats, tickets, documents, web addresses, or source-code repositories. Store it in the integration's secrets manager and send it only over HTTPS.
Choose the integration identity and permissions
Before generating a credential, decide which employee will represent the integration. They must be active and have only the permissions needed for the intended operations.
Review their permission groups, allowed features, and employee scope. Enabling API access does not grant new permissions: if the employee cannot perform an action in Talento, their token should not be able to perform it through the API.
Tip
Use a stable, clearly identified identity for each important integration. Avoid reusing one person's token across several providers or processes.
Enable API access
Open Employees, select the employee record, and find API access. Enable access to generate the first token.
The credential is tied to that employee and the current company. Do not share one token between companies or use it against another account's address.
Save the token when it is shown
Talento shows the complete token only immediately after generating it. Copy it to the integration's secrets manager at that point and restrict access to the secret.
On later visits, only the final four characters are shown so you can identify the configured credential. Talento cannot display the existing full value again.
Rotate a compromised or lost token
If the token has been lost, may be known by an unauthorised person, or needs routine renewal, use the regenerate action under API access.
Creating the new token immediately invalidates the previous one. Save the new value when it appears, update the secrets manager, and verify the integration. Coordinate planned changes to reduce interruption, but rotate immediately whenever exposure is suspected.
Revoke API access
Disable API access when the integration is no longer used, changes identity, or the token can no longer be stored securely. Revocation removes the active credential, and subsequent requests can no longer authenticate.
Review employees with API access regularly, especially after provider, permission, feature, or employment changes. An inactive employee cannot authenticate with their old token.
Result
You can verify the result on the settings page, in the relevant list, or through the status described in the steps above.
Common issues
If an option is unavailable, check the active module, the specific permission, and the record scope. If the settings are correct and the issue continues, keep the displayed message and contact support.