# Authentication

The CV-Transformer API uses API keys for authentication. Create and manage them under Settings → API keys of your organization in the [admin dashboard](https://www.cv-transformer.com/admin). Provide the key in the HTTP Authorization header as a bearer token.

A key is shown once, when you create it: CV-Transformer stores only a hash of it. Keep it secret, like a password. If a key may have leaked, rotate it from its page: the old key stops working immediately, and the key keeps its settings and request history.

## [Scopes](#scopes)

A key has full access, or read or write access per area: candidates, layouts, members, organization and webhooks. Write access includes read access. A request without a valid key gets a `401` response, and a request the key's scopes don't allow gets a `403`. Embedded resources the key can't read are left out of responses. Each endpoint in this reference names the scope it needs.

## [Trying requests](#trying-requests)

Every example in this reference can be sent from the page: open it with the send button and enter an API key. The key stays in this browser tab, and requests run against your live data.

Example

```
curl "https://api.cv-transformer.com/v1/layouts?select=id,name" \
  -H "Authorization: Bearer YOUR_API_KEY"
```