ShiftSync API

The ShiftSync API is a RESTful, OAuth 2.0–secured HTTP API for building third-party integrations against a user’s shift-planning account — shifts, templates, friends, groups, pay, and more.

Base URL

All endpoints are served from:

https://api.shiftsync.app

Versioning

The API is versioned by URI prefix — every data endpoint path begins with /v1, e.g.:

GET https://api.shiftsync.app/v1/shifts

The OAuth 2.0 and discovery endpoints (/oauth/* and /.well-known/*) are part of the protocol surface and are not versioned.

Discovery

The server publishes its OAuth 2.0 metadata (authorization/token endpoints, supported scopes, and grant types) at the standard discovery URL:

GET https://api.shiftsync.app/.well-known/oauth-authorization-server

client_id_metadata_document_supported: true in that document means you can use an HTTPS URL you host as your client_id instead of registering a client — see Identifying your app.

API Reference

Browse every endpoint, its parameters, request/response schemas, and the OAuth scope each one requires in the API Reference.

SDK

Prefer a typed client to raw HTTP? The official @shiftsync/sdk package provides an OAuth-scoped ApiClient, request/response types for every endpoint, and OAuth 2.0 / PKCE helpers for the authorization-code flow.

npm install @shiftsync/sdk

import { ApiClient } from '@shiftsync/sdk'

const client = new ApiClient('https://api.shiftsync.app', {
    accessToken,
    refreshToken,
    expiresAt,
})

const { items: shifts } = await client.getShifts({ start, end })

The SDK is ESM-only and ships full TypeScript types. Fuller SDK guides are coming; for now the API Reference documents every underlying endpoint.

Manage your apps

Register OAuth apps, manage their redirect URIs and scopes, rotate secrets, and upload an app icon in the App console — or skip registration entirely and identify your app by a URL you host. See Identifying your app.