[Developers](https://www.cv-transformer.com/zh/docs/developers) [Connected apps and OAuth](https://www.cv-transformer.com/zh/docs/developers/connected-apps)

# Connected apps and OAuth

阅读需 1 分钟

Apps, such as AI assistants and integrations built by others, can connect to CV-Transformer with OAuth. Each user then chooses which of their organizations the app may use and what it may do there, without sharing an API key.

## [Connecting an app](#connecting-an-app)

When an app asks to connect, CV-Transformer asks you to sign in and shows what the app wants:

- **Organizations**: you can give access to organizations where you have the **Manage settings** permission.
- **Access** per area, such as candidates or layouts: none, read, or read and write.
- Whether the app stays connected until you disconnect it.

Click **Allow access** to return to the app. CV-Transformer warns when it hasn't verified an app; only continue if you trust it.

## [Managing connected apps](#managing-connected-apps)

- Your own apps are under **Settings** → **Connected apps** in your account settings, where you can see what each may do and disconnect it.
- An organization's connected apps are listed under **Settings** → **API keys**, where members who manage settings can remove them.

An app loses access to an organization when you lose the **Manage settings** permission there. Webhooks an app created stop when it loses access.

## [Building an app](#building-an-app)

CV-Transformer is an OAuth 2.1 authorization server. Apps find its endpoints at `https://www.cv-transformer.com/.well-known/oauth-authorization-server`.

- **Flow**: authorization code with PKCE (`S256`). Every app is a public client: it doesn't get a client secret.
- **Registration**: register with [Dynamic Client Registration](https://datatracker.ietf.org/doc/html/rfc7591) at `/oauth/register`, or use a URL of a client metadata document as your `client_id`.
- **Scopes**: the [API key scopes](https://www.cv-transformer.com/en/docs/developers/api-keys#scopes), such as `candidates:read`, and `offline_access` for a refresh token. Without a `scope` parameter, the app asks for everything and the user chooses.
- **Tokens**: access tokens last an hour; refresh tokens last 30 days. Revoke tokens at `/oauth/revoke`.

Use the access token as a bearer token with the [API](https://www.cv-transformer.com/en/api-reference) and the [MCP server](https://www.cv-transformer.com/en/docs/developers/mcp-server). Requests show in the organization's logs as your app acting for the user.

[上一页MCP server](https://www.cv-transformer.com/zh/docs/developers/mcp-server) [下一页Security and privacy](https://www.cv-transformer.com/zh/docs/security)