LogQuillAPI keys
Keys for your own scripts and tools, to read and write your time in LogQuill through its REST API.
Who: everyone, as long as your site allows the API (it does unless an administrator turned it off). Public API settings
An API key lets a script or another tool use LogQuill's REST API as you: export your time, log time from another system, read your team's timesheets. The same key connects an AI assistant such as Claude to LogQuill. AI assistants (MCP) A key acts as you, so:
- it only does what you ticked when you made it;
- it never does more than your role allows in LogQuill, checked again on every call, so a change to your role applies straight away;
- time it logs shows you as the author, in LogQuill and in Jira, and the audit log notes it was done through the API, with the start of the key.
Make a key
Open your menu (your name at the bottom of the sidebar), then API keys, then Create a key.
Give it a name that says where it's used ("Payroll export"), and tick its access, part by part:
| Part | Read | Write |
|---|---|---|
| Worklogs | Logged time you may see | Log, change and delete your own time |
| Plans | Planned time you may see | Plan, change and delete your own plans |
| Timesheets | Your timesheets, and those you review | Submit yours; approve and send back those you review |
| Time totals | Totals by person, issue, project, account, work type or day, as in reports | |
| Teams | The teams you may see, and their members | |
| Absences | Time off you may see, as on the Absences page, and the absence types | Ask for your own time off (sick leave too) and cancel it, as on the Absences page |
Tick only what the script needs. A key that reads totals for payroll doesn't need to write anything.
Choose when it expires: 30 days to a year, 90 days unless you change it. Then Create key.
Copy the key now. It's shown once, and never again: LogQuill only keeps a fingerprint of it. If you lose it, revoke it and make a new one. The dialog also shows a first call to try it with.
Screenshot to add: public/screenshots/your-time/api-key-create.png
The Create an API key form, with a name, the access table and the expiry.
Your menu (name at the bottom of the sidebar) → API keys → Create a key. Type a name ("Payroll export"), tick Worklogs read and Time totals read, and capture the whole form with the expiry and its date.
Screenshot to add: public/screenshots/your-time/api-key-created.png
A new key shown once, with Copy and an example call.
Finish the form above with Create key. Capture the warning, the key with Copy, and the example call. Blur or crop most of the key itself before saving the picture.
Use it
Send the key in the Authorization header of every request, and nowhere else:
curl -H "Authorization: Bearer logquill_..." https://<the API address>/v1/meGET /v1/me answers with who the key acts as and what it may do: a good first call. Everything
else is in the API section: the endpoints, paging, errors and examples.
A key belongs to the Jira site you made it on, and only reads and writes that site's time. If you use LogQuill on several sites, make a key on each, and name it after the site.
Keep keys like passwords: in your tool's secret settings, never in code you share, a chat or a ticket.
Your keys
API keys in your menu lists your keys: their name, the start of the key, what they may do, when they expire and when they were last used.
Screenshot to add: public/screenshots/your-time/api-keys-list.png
The API keys dialog listing two keys with their access, expiry and last use.
Your menu → API keys, with two keys made (one used at least once). Capture the dialog with both keys, their access badges, expiry and last use, and the Create a key button.
Revoke stops a key at once; whatever uses it gets refused from then on. You can hold up to 10 keys.
When keys stop working
- They expire, on the date shown. You get an email a week before (the day before, for a key made to last two weeks or less), and another once it has expired.
- You, or an administrator, revoke them. When an administrator revokes one of yours, you get an email saying so. It doesn't name who.
- An administrator turns the API off for the site. Keys come back when it's turned on again.
- Your Atlassian account is deactivated. If it's closed for good, your keys are deleted.
- The app is uninstalled: every key is deleted at once.
- LogQuill can't reach your site (the app disabled for two days, say): keys are kept but answer
503until it can again. - While the site's subscription is inactive, keys can still read but not write. You can still make keys then, with read access only, for example to take your data out before it's deleted.
Limits
Each key can make 60 requests a minute, and the whole site 600. Writes (logging, changing or deleting
time and plans) are also limited to 300 an hour for the whole site: they go to Jira, whose allowance
every LogQuill customer shares. Past a limit, the API answers 429 with Retry-After: the seconds to
wait.