Connected apps and OAuth

1 min lezen

Apps, such as AI assistants and integrations built by others, can connect to CV-Transformer with OAuth. Each user then chooses which of their organizations the app may use and what it may do there, without sharing an API key.

Connecting an app

When an app asks to connect, CV-Transformer asks you to sign in and shows what the app wants:

  • Organizations: you can give access to organizations where you have the Manage settings permission.

  • Access per area, such as candidates or layouts: none, read, or read and write.

  • Whether the app stays connected until you disconnect it.

Click Allow access to return to the app. CV-Transformer warns when it hasn't verified an app; only continue if you trust it.

Managing connected apps

  • Your own apps are under Settings → Connected apps in your account settings, where you can see what each may do and disconnect it.

  • An organization's connected apps are listed under Settings → API keys, where members who manage settings can remove them.

An app loses access to an organization when you lose the Manage settings permission there. Webhooks an app created stop when it loses access.

Building an app

CV-Transformer is an OAuth 2.1 authorization server. Apps find its endpoints at https://www.cv-transformer.com/.well-known/oauth-authorization-server.

  • Flow: authorization code with PKCE (S256). Every app is a public client: it doesn't get a client secret.

  • Registration: register with Dynamic Client Registration at /oauth/register, or use a URL of a client metadata document as your client_id.

  • Scopes: the API key scopes, such as candidates:read, and offline_access for a refresh token. Without a scope parameter, the app asks for everything and the user chooses.

  • Tokens: access tokens last an hour; refresh tokens last 30 days. Revoke tokens at /oauth/revoke.

Use the access token as a bearer token with the API and the MCP server. Requests show in the organization's logs as your app acting for the user.