API keys

1 min de lecture

API keys give scripts and integrations access to your organization through the API and the MCP server. Manage them under Settings → API keys; you need the Manage settings permission.

Creating a key

Click API Key, describe what it is for, such as "Production" or "Zapier", and choose its scopes. The key is shown once: copy it and store it somewhere safe, such as your secrets manager. CV-Transformer only keeps a hash of it.

Send the key as a bearer token: Authorization: Bearer YOUR_API_KEY. See Authentication.

Scopes

A key has Full access, or No access, read or write access per area. Write access includes read access. Give a key only what it needs.

  • Candidates (candidates:read, candidates:write): candidates, their proposals, views and analytics.

  • Layouts (layouts:read, layouts:write): layouts.

  • Members (members:read, members:write): members and their profiles, and invitations.

  • Organization (organization:read, organization:write): organization details, billing, credits and API usage.

  • Webhooks (webhooks:read, webhooks:write): webhooks and their notifications.

Rate limits

Each key may make 120 requests per minute by its default limit. Requests over the limit get a 429 response with a Retry-After header. A key's page shows its requests in the last minute and how often it was rate limited in the last week. Click Request more to ask for a higher limit. See Rate limits.

Rotating and revoking

  • Rotate replaces the key with a new one. The old key stops working immediately; the key keeps its settings and history.

  • Revoke API key deletes the key, so it stops working.

Rotate a key when it may have leaked, such as after someone with access to it leaves.

Monitoring

Every request with a key shows under Settings → Logs → API requests, and every change it makes in the activity log. See Logs.