---
title: "Best Practices"
source: "https://palt.ohmyteam.cc/best-practices"
---

# Best Practices

## Security

- Always use HTTPS.
- Store API keys securely (e.g., environment variables, not in code).
- Use OAuth scopes minimally.
- Rotate API keys periodically.

## Usage Tips

- **Permissions**: Ensure your API user has role-based access for endpoints (e.g., admin for files).
- **Pagination**: Check for pagination in list endpoints (e.g., employees, reports).
- **File Uploads**: Limit to 20MB; categorize properly to avoid 404/413.
- **Webhooks**: Verify payloads with signatures; handle retries.
- **Deprecated Endpoints**: Avoid `/api/v1/login` (deprecated).

## Example: Robust Client

```python
import requests

base_url = 'https://acme.bamboohr.com/api/v1'
auth = ('acme', 'your-api-key')

response = requests.get(f'{base_url}/datasets', auth=auth)
if response.status_code == 200:
    print(response.json())
else:
    print(f'Error: {response.status_code} - {response.text}')
```

## Performance

- Cache static data (e.g., datasets).
- Use filters/parameters to reduce payload size.
- Monitor `Last Change Information` for incremental updates.