Authentication and access

Every v3 request requires a company API token in the Authorization: Bearer <token> header. Tokens belong to your company and grant company-wide access to recruiting records. Integrations can keep running when the person who created the token leaves the company.

Create a token for each integration

System Admins can manage up to 10 API tokens in Company Settings → Developer → API tokens. Use a separate token for each integration so you can identify its usage and replace or revoke its credentials independently. Each token grants the same company-wide access.

1. Open Company Settings → Developer → API tokens.
2. Create a token and give it a name that identifies the integration, such as HR reporting or Careers website.
3. Copy the full token value when it appears. It is shown only once. New tokens start with join_sk_; a migrated token may have no prefix.
4. Store it in your server’s secret manager or environment and configure your integration to use it.

Keep tokens outside source control, browser code and mobile apps. Examples in these guides expect JOIN_API_TOKEN to be set securely in your environment. Do not paste a real token into documentation or request logs.

Authorization: Bearer <company-api-token>
Join-Version: 2026-11-01

Manage your company’s tokens

Return to Company Settings → Developer → API tokens to manage access:

• Rename a token to keep its purpose clear as your integrations change.
• Check when it was last used to help identify active integrations and credentials that may no longer be needed.
• Revoke a token when an integration no longer needs access or a credential has been exposed. Revocation prevents future requests using that token; requests already processed keep their effects. Other company tokens continue to work.

Replace or rotate a token

1. Create a replacement token.
2. Configure the integration to use the new value.
3. Verify a successful request, such as reading one job.
4. Revoke the old token.

If you lose a token’s full value, use the same replacement process.

Existing v2 credentials

Existing v2 keys have been converted to company tokens with the same values, so integrations can continue using their credentials. New company tokens also work with v2. Manage both in the Developer section; the former personal API page redirects there.

Company API access

Your company’s subscription must include API access. If it does not, the Developer section shows an upgrade prompt. Tokens pause when the company loses API access, and requests are rejected even when the token is valid. Tokens resume when company API access is restored.

Authentication failures

Fix the credential or access issue before retrying. Continue with Your first API request.