How to Integrate Lovable with Time Doctor

Time Doctor API v2 uses OAuth2 for authentication. For server-side integrations like Lovable Edge Functions, you need an access token. The simplest approach for admin access to your own company's data is to use Time Doctor's password-based OAuth2 grant (resource owner credentials), which lets you exchange your username and password for an access token without a browser redirect. To get your access token, you need your Time Doctor company's API credentials. Log into your Time Doctor account, then navigate to app.timedoctor.com/account-settings or the API settings section. You'll find your client ID — for standard API access, Time Doctor uses a public client ID that you can find in their API documentation at timedoctor.com/api. Use this to request a token via their OAuth2 endpoint. For a simpler setup process, Time Doctor also provides access tokens directly in some account settings pages. Check app.timedoctor.com → Account Settings → API Access for a token you can use immediately. Copy the access token and your company ID (visible in the URL when viewing your Time Doctor dashboard). In your Lovable project, open Cloud → Secrets and add: TIMEDOCTOR_ACCESS_TOKEN with your token, and TIMEDOCTOR_COMPANY_ID with your numeric company ID. The company ID is required for most API endpoints — it scopes all requests to your organization's data.

Time Doctor's API v2 at api2.timedoctor.com requires the company ID as a path component in most endpoints — the pattern is /v1.1/companies/{companyId}/{resource}. This scoping ensures all data access is organization-specific. The Bearer token in the Authorization header authenticates the user making the request, while the company ID in the path scopes to the correct organization. The most valuable Time Doctor data for management dashboards comes from three endpoints: the users list (who is in the team), the work sessions endpoint (who is actively working right now and when they started), and the activity summary endpoint (daily productivity scores, productive vs unproductive time breakdowns). Time entries provide the raw hour logs, while work sessions capture the granular active/idle patterns that distinguish Time Doctor from simpler trackers.

1// supabase/functions/timedoctor-proxy/index.ts
2import { serve } from "https://deno.land/std@0.168.0/http/server.ts";
3
4const corsHeaders = {
5  "Access-Control-Allow-Origin": "*",
6  "Access-Control-Allow-Headers": "authorization, x-client-info, apikey, content-type",
7};
8
9serve(async (req) => {
10  if (req.method === "OPTIONS") {
11    return new Response("ok", { headers: corsHeaders });
12  }
13  const token = Deno.env.get("TIMEDOCTOR_ACCESS_TOKEN");
14  const companyId = Deno.env.get("TIMEDOCTOR_COMPANY_ID");
15  if (!token || !companyId) {
16    return new Response(JSON.stringify({ error: "Time Doctor credentials not configured" }), {
17      status: 500, headers: { ...corsHeaders, "Content-Type": "application/json" },
18    });
19  }
20  const base = `https://api2.timedoctor.com/api/1.1/companies/${companyId}`;
21  const authHeaders = { Authorization: `Bearer ${token}`, "Content-Type": "application/json" };
22  const { action, params = {} } = await req.json();
23  let resp;
24
25  switch (action) {
26    case "list_users": {
27      const q = new URLSearchParams({ status: params.status || "active" });
28      resp = await fetch(`${base}/users?${q}`, { headers: authHeaders });
29      break;
30    }
31    case "get_user":
32      resp = await fetch(`${base}/users/${params.userId}`, { headers: authHeaders });
33      break;
34    case "list_work_sessions": {
35      const q = new URLSearchParams();
36      if (params.userId) q.set("userId", params.userId);
37      if (params.start) q.set("start", params.start);
38      if (params.end) q.set("end", params.end);
39      resp = await fetch(`${base}/work-sessions?${q}`, { headers: authHeaders });
40      break;
41    }
42    case "get_activity_summary": {
43      const q = new URLSearchParams();
44      if (params.userId) q.set("userId", params.userId);
45      if (params.start) q.set("start", params.start);
46      if (params.end) q.set("end", params.end);
47      resp = await fetch(`${base}/activity/summary?${q}`, { headers: authHeaders });
48      break;
49    }
50    case "list_time_entries": {
51      const q = new URLSearchParams();
52      if (params.userId) q.set("userId", params.userId);
53      if (params.start) q.set("start", params.start);
54      if (params.end) q.set("end", params.end);
55      resp = await fetch(`${base}/activity/regular?${q}`, { headers: authHeaders });
56      break;
57    }
58    case "get_productivity": {
59      const q = new URLSearchParams();
60      if (params.userId) q.set("userId", params.userId);
61      if (params.start) q.set("start", params.start);
62      if (params.end) q.set("end", params.end);
63      resp = await fetch(`${base}/statistics/activity?${q}`, { headers: authHeaders });
64      break;
65    }
66    case "list_projects":
67      resp = await fetch(`${base}/projects`, { headers: authHeaders });
68      break;
69    default:
70      return new Response(JSON.stringify({ error: `Unknown action: ${action}` }), {
71        status: 400, headers: { ...corsHeaders, "Content-Type": "application/json" },
72      });
73  }
74
75  const data = await resp.json();
76  return new Response(JSON.stringify(data), {
77    status: resp.status, headers: { ...corsHeaders, "Content-Type": "application/json" },
78  });
79});

With the Edge Function deployed, you can build a comprehensive team monitoring dashboard. The most useful first view is a team status page showing who is currently working — Time Doctor's work sessions endpoint provides real-time status including whether a session is active or paused. Combining this with today's productivity score from the activity summary gives managers an immediate picture of team engagement. For privacy-conscious implementations, consider which Time Doctor data to surface in your Lovable app. Aggregate productivity scores and work hours are generally appropriate to share with team members themselves, while detailed app/website usage and screenshot data should typically remain admin-only. Design your Lovable UI with role-based visibility — show employees their own data, show managers the team view. For complex RBAC requirements, RapidDev's team can help design the permission layer.

A daily dashboard is useful for real-time monitoring, but weekly summary reports are what managers use for performance reviews, payroll, and client billing. Adding a weekly view to your Time Doctor Lovable integration requires fetching activity summary data across a 7-day range and aggregating daily figures into weekly totals per user. The Time Doctor API returns daily breakdowns in the activity summary response — each day in the range is a separate entry in the results array. Your frontend aggregates these into weekly totals, calculates averages, and identifies trends (e.g., is productivity improving or declining week over week?). The export feature is particularly valuable for payroll processing — a CSV with employee name, hours logged, and productivity score is typically all that's needed for weekly payroll review.