[Developers](https://www.cv-transformer.com/fr/docs/developers) [API keys](https://www.cv-transformer.com/fr/docs/developers/api-keys)

# API keys

1 min de lecture

API keys give scripts and integrations access to your organization through the [API](https://www.cv-transformer.com/en/api-reference) and the [MCP server](https://www.cv-transformer.com/en/docs/developers/mcp-server). Manage them under **Settings** → **API keys**; you need the **Manage settings** permission.

## [Creating a key](#creating-a-key)

Click **API Key**, describe what it is for, such as "Production" or "Zapier", and choose its scopes. The key is shown once: copy it and store it somewhere safe, such as your secrets manager. CV-Transformer only keeps a hash of it.

Send the key as a bearer token: `Authorization: Bearer YOUR_API_KEY`. See [Authentication](https://www.cv-transformer.com/en/api-reference/authentication).

## [Scopes](#scopes)

A key has **Full access**, or **No access**, read or write access per area. Write access includes read access. Give a key only what it needs.

- **Candidates** (`candidates:read`, `candidates:write`): candidates, their proposals, views and analytics.
- **Layouts** (`layouts:read`, `layouts:write`): layouts.
- **Members** (`members:read`, `members:write`): members and their profiles, and invitations.
- **Organization** (`organization:read`, `organization:write`): organization details, billing, credits and API usage.
- **Webhooks** (`webhooks:read`, `webhooks:write`): webhooks and their notifications.

## [Rate limits](#rate-limits)

Each key may make 120 requests per minute by its default limit. Requests over the limit get a `429` response with a `Retry-After` header. A key's page shows its requests in the last minute and how often it was rate limited in the last week. Click **Request more** to ask for a higher limit. See [Rate limits](https://www.cv-transformer.com/en/api-reference/rate-limits).

## [Rotating and revoking](#rotating-and-revoking)

- **Rotate** replaces the key with a new one. The old key stops working immediately; the key keeps its settings and history.
- **Revoke API key** deletes the key, so it stops working.

Rotate a key when it may have leaked, such as after someone with access to it leaves.

## [Monitoring](#monitoring)

Every request with a key shows under **Settings** → **Logs** → **API requests**, and every change it makes in the activity log. See [Logs](https://www.cv-transformer.com/en/docs/organization/logs).

[PrécédentDevelopers](https://www.cv-transformer.com/fr/docs/developers) [SuivantEmbedding](https://www.cv-transformer.com/fr/docs/developers/embedding)