Timerfly API & webhooks

curl

curl https://api.timerfly.com/api/v1/days?from=2026-09-01&to=2026-09-30 \
  -H "Authorization: Bearer tf_your_key"

JavaScript (Node 18+)

const res = await fetch('https://api.timerfly.com/api/v1/days?from=2026-09-01&to=2026-09-30', {
  headers: { Authorization: `Bearer ${process.env.TIMERFLY_KEY}` },
});
const { data } = await res.json();
const absent = data.filter((d) => d.status === 'absent');

Python

import os, requests
r = requests.get("https://api.timerfly.com/api/v1/days",
    params={"from": "2026-09-01", "to": "2026-09-30"},
    headers={"Authorization": f"Bearer {os.environ['TIMERFLY_KEY']}"})
for d in r.json()["data"]:
    print(d["date"], d["member"]["name"], d["status"], d["trackedSec"] // 3600, "h")

Google Sheets (Apps Script): yesterday’s attendance, every morning

// Google Sheets: Extensions → Apps Script. Put the key in Project Settings → Script properties (TIMERFLY_KEY).
function loadYesterday() {
  const key = PropertiesService.getScriptProperties().getProperty('TIMERFLY_KEY');
  const day = Utilities.formatDate(new Date(Date.now() - 864e5), 'Asia/Kolkata', 'yyyy-MM-dd');
  const res = UrlFetchApp.fetch('https://api.timerfly.com/api/v1/days?from=' + day, { headers: { Authorization: 'Bearer ' + key } });
  const rows = JSON.parse(res.getContentText()).data.map((d) =>
    [d.date, d.member.name, d.status, d.arrivalAt, d.departureAt, Math.round(d.trackedSec / 36) / 100, d.late]);
  if (rows.length) SpreadsheetApp.getActiveSheet().getRange(SpreadsheetApp.getActiveSheet().getLastRow() + 1, 1, rows.length, 7).setValues(rows);
}
// Then Triggers → Add trigger → loadYesterday, time-driven, every day at 6–7 am.

Node.js

import crypto from 'node:crypto';

// req.rawBody: the request body exactly as received (before JSON.parse).
function isFromTimerfly(rawBody, header, secret) {
  const { t, v1 } = Object.fromEntries(header.split(',').map((p) => p.split('=')));
  if (Math.abs(Date.now() / 1000 - Number(t)) > 300) return false; // older than 5 minutes: replay
  const expected = crypto.createHmac('sha256', secret).update(`${t}.${rawBody}`).digest('hex');
  return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(v1));
}

Python

import hmac, hashlib, time

def is_from_timerfly(raw_body: bytes, header: str, secret: str) -> bool:
    parts = dict(p.split("=", 1) for p in header.split(","))
    if abs(time.time() - int(parts["t"])) > 300:
        return False
    expected = hmac.new(secret.encode(), f"{parts['t']}.".encode() + raw_body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, parts["v1"])

PHP

function is_from_timerfly(string $rawBody, string $header, string $secret): bool {
    parse_str(str_replace(',', '&', $header), $p);
    if (abs(time() - (int) $p['t']) > 300) return false;
    $expected = hash_hmac('sha256', $p['t'] . '.' . $rawBody, $secret);
    return hash_equals($expected, $p['v1']);
}
// $raw = file_get_contents('php://input'); $sig = $_SERVER['HTTP_TIMERFLY_SIGNATURE'];