> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hotfix.jobs/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Product noun is jobs.
> MCP at https://rest.hotfix.jobs/mcp is the hiring contract for agents with a company API key.
> Do not invent unpublished REST, hiring stats, or webhooks.
> Do not mention Greenhouse, Ashby, Quick Apply, or claim.
> Creating a draft, offer, or booking link does not send email.

# Authentication

> Send Authorization: Bearer hf_… on every agent request. Mint the key at Org → API.

Agents authenticate with a company API key. There is no OAuth flow. The key is the company. Do not send a company id.

```
Authorization: Bearer hf_…
```

## Create a key

1. In the app, open **Org → API**.
2. Create a key as an owner or admin. A basic member cannot. Keys unlock on a hosted plan.
3. Copy the secret when it appears. Hotfix stores a hash. You will not see the secret again.
4. Put it in an environment variable. Do not commit it.

Prefix is `hf_`. Cap is 20 keys per company.

## Call with the key

Use the same header on MCP and on [GET resume](/reference/resume).

```bash theme={null}
curl https://rest.hotfix.jobs/v1/employer/applications/2c8f0a1e-4b3d-4e91-9c7a-1f6b8d2e0a11/resume \
  -H "Authorization: Bearer hf_…"
```

That path returns the PDF. [Get started](/hiring-mcp/get-started) shows how to put the header on Cursor, Claude Code, and other MCP clients.

## What the key can call

The key can call every [MCP tool](/hiring-mcp/tools) for that company, and [GET resume](/reference/resume).

Other `/v1/employer` routes take an employer session from the dashboard, not this key.

## Errors

A bad or missing key returns `401` before a tool runs.

```json theme={null}
{
  "error": "invalid_token",
  "error_description": "A valid API key is required."
}
```

## Dashboard session

The dashboard sends a session JWT on `/v1/employer`. You do not mint or send that token. Org admin is required. The org on the token is the company.