Skip to main content
Agents authenticate with a company API key. There is no OAuth flow. The key is the company. Do not send a company id.

​
Create a key

  1. In the app, open Org → API.
  2. Create a key as an owner or admin. A basic member cannot. Keys unlock on a hosted plan.
  3. Copy the secret when it appears. Hotfix stores a hash. You will not see the secret again.
  4. Put it in an environment variable. Do not commit it.
Prefix is hf_. Cap is 20 keys per company.

​
Call with the key

Use the same header on MCP and on GET resume.
That path returns the PDF. Get started shows how to put the header on Cursor, Claude Code, and other MCP clients.

​
What the key can call

The key can call every MCP tool for that company, and GET resume. Other /v1/employer routes take an employer session from the dashboard, not this key.

​
Errors

A bad or missing key returns 401 before a tool runs.

​
Dashboard session

The dashboard sends a session JWT on /v1/employer. You do not mint or send that token. Org admin is required. The org on the token is the company.