API keys
Create public keys for the delivery API, so your website and the Careers SDK can read published jobs and send applications, and management tokens for scripts and other systems.
How-to guide3 min read
API keys has two kinds of credentials. Everyone can see the page; only admins create, rename and revoke.
careers_pk_careers_mt_| Starts with | For | Where it may live | |
|---|---|---|---|
| Public key | careers_pk_ | The delivery API, GraphQL and the SDKs: published jobs, the career site, applications, the talent pool and the candidate portal | In a browser or an app |
| Management token | careers_mt_ | The management API: jobs, applications, candidates and stages | On a server only |
The panel beside the lists shows both addresses for your organisation.
Create a public key
- Under Public keys, choose New key and give it a name, such as northwilds.com.
- Choose when it expires: Never, In 30 days, In 90 days or In a year. A key for a live website usually never expires.
- Turn on Read internal-only jobs only for an intranet page, and keep that key on a server.
- Copy the key. It is shown once: only a hash of it is stored.
The list shows what each key reads (Published or Internal too), its requests in the last 30 days and when it was last used. Create one key per website or app, so you can see who calls and revoke one without the others.
Using a key
Send it as a bearer token:
curl -H "Authorization: Bearer careers_pk_..." \ "https://api.bifrostorbit.com/careers/v1/jobs?locale=de"X-Api-Key: careers_pk_... and ?key=careers_pk_... work too. A public key only reads what your career pages show and sends applications, so it is safe in a browser; the Careers SDK's apply form uses one.
Revoke and remove
Choose the menu beside a key, then Revoke. It stops at once: its next request gets 401. A revoked key can then be removed, with a moment to undo. Rename changes only the name.
Create a management token
Management tokens are in the Growth and Enterprise plans. See Plans and the trial.
- Under Management tokens, choose New token, give it a name, such as HR system, and say what it is for.
- Choose when it expires: In 30 days, In 90 days or In a year. Tokens always expire.
- Leave Read only on unless the system needs to move, reject or tag candidates, add notes, or publish and close jobs.
- Choose Create token and copy it. It is shown once and must stay on a server.
A token acts as the person who created it, with that person's role at the time of each request. If their role changes, so does what the token can reach. It stops working when that person loses Careers Orbit in Orbit.
Admins see every token, with who it acts as, whether it may change things and when it was last used. Everyone else sees only their own. Revoking a token stops it at once. Everything a token does is in the audit trail as, for example, Token "HR system" for Ingrid Berg.
If a key is lost
Careers Orbit can't show a key or token again. Revoke it and create another.
Was this page helpful?