Skip to content

Paycor API Token

Service Name: Paycor

Service Description: Paycor is a human capital management (HCM) platform that provides HR, payroll, time, recruiting, and onboarding solutions for businesses of all sizes. The API allows programmatic access to Paycor's services.

Service Address: https://www.paycor.com/

Validation Type: API Auth

IP Allow list: IP restrictions can be configured at the account level through Paycor's security settings.

Secret Access Scope: Grants programmatic access to Paycor's HR and payroll data, including employee information, payroll processing, time tracking, and other HR functions depending on the permissions assigned to the API token.

Secret Revokement URL: https://secure.paycor.com/Accounts/Developer

Secret Example: pc_api_tkn_12345abcdef67890ghijklmnopqrstuvwxyz

Suspicious Activity Investigation Instructions:

  • Review API access logs in the Paycor developer portal for unusual activity
  • Check for unauthorized data access or modifications to employee or payroll information
  • Monitor for unusual API call patterns or access from unexpected locations
  • Verify if any automated processes using the API token have been modified
  • Check for any data exports or mass changes to employee records

Mitigation Instructions:

  • Log in to your Paycor account and navigate to the Developer section

  • Locate the compromised API token in the list of active tokens

  • Click "Revoke" or "Delete" to immediately invalidate the token

  • Generate a new API token with appropriate permissions if needed
  • Update any legitimate applications or integrations with the new token
  • Review and adjust API token permissions to follow the principle of least

privilege

  • Consider implementing IP restrictions for API access if not already in place
  • Enable additional security measures such as audit logging for API activities