Agent skill · software engineering · jeremylongshore
bamboohr-install-auth
Choose and configure BambooHR OAuth 2.0 or API-key authentication without leaking HR credentials. Use when registering a partner integration, wiring token refresh, or repairing tenant authentication. Trigger with "BambooHR auth", "BambooHR OAuth", "BambooHR API key", or "BambooHR token refresh".
Why this skill is useful
Adds executable scripts and detailed setup instructions for authenticating with the BambooHR API, which are not commonly found in public documentation.
What it needs
Requires node, npm, pip, python installed locally. Requires bamboohr account access. About 3k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
BambooHR Authentication Setup Overview Configure the narrowest BambooHR identity that fits the integration. OAuth 2.0 is BambooHR's recommended path for partner integrations. An API key is suitable for an internal tool or prototype when its owning user's permissions and key lifecycle are acceptable. Prerequisites The target repository or integration path and the requested operator outcome. The tenant, identity, and data scope only when approved live work is in scope. The current evidence register plus customer-specific permissions and agreements. Current Contract Tenant API host: https://{company-subdomain}.bamboohr.com. Authorization endpoint: https://{company-subdomain}.bamboohr.com/authorize.php. Token endpoint: POST https://{company-subdomain}.bamboohr.com/token.php?request=token. API-key requests use HTTP Basic authentication with the key as username and x as password. BambooHR's official Python source supports OAuth, refresh, API keys, request IDs, retry controls, and redacted logging. As of 2026-09-11 the documented bamboohr-sdk distribution is not discoverable on public PyPI; verify the registry before installing or use an approved commit pin. Authentication For OAuth, register an HTTPS redirect URI, generate a high-entropy state, bind it to the initiating session, and reject callbacks whose state does not match. Exchange the code server-side. Store access token, refresh token, expiry, tenant, subject, and granted scope in an encrypted, tenant-scoped record. For API keys, create a dedicated BambooHR user with only required field and workflow permissions. Store the key in the deployment secret manager. Never put it in .env.example, logs, shell history, test fixtures, or a client bundle. Instructions 1. Identify whether the integration is partner/multi-tenant or internal/single- tenant, and record the authentication decision. 2. Derive the tenant subdomain from the customer's BambooHR URL; do not accept a full arbitrary host from untrusted input. 3. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/bamboohr-install-auth