Create an API Key
API access is available on Growth and Enterprise. Use it to create assessments, invite candidates, and pull reports from your own systems.
Creating a key
Settings → Developer → API keys → New key. Give it a name describing where it will be used — "ATS sync (production)" is a name you can revoke confidently a year from now.
The key is shown once. Copy it immediately. We store only a hash, so a lost key must be replaced.
Scopes
Grant only what the integration needs:
| Scope | Grants |
|---|---|
assessments:read | List and read assessments |
assessments:write | Create and update assessments |
candidates:read | List candidates and invitation status |
candidates:create | Send invitations |
reports:read | Read scores and reports |
reports:read:full | Read full session telemetry and replays |
reports:read:full exposes complete candidate session data. Grant it only where you genuinely need the raw telemetry.
Using a key
Send it as a bearer token:
Authorization: Bearer <your-api-key>
Keys are scoped to one organization. Requests are rate limited per key; the limit and remaining quota come back in the response headers.
Keeping keys safe
- Never commit a key. Use environment variables or a secret manager.
- One key per integration and per environment, so revoking is surgical.
- Rotate on a schedule, and immediately whenever someone with access leaves.
- Never put a key in browser code. Anything in the browser is public.
Revoking
Revocation is immediate and cannot be undone. Requests with the key start failing straight away, so make sure you know what is using it first.