Authentication
Every call sends the company's website API key in the X-Api-Key header:
GET /v1/website/jobs HTTP/1.1
Host: api.gofindneo.com
X-Api-Key: fnjobs_your_key
The key tells FindNeo which company you are. There is no sign-in, no token to refresh and no company id to send.
Access
A key has one of two kinds of access, chosen when it's created:
| Access | Calls it can make |
|---|---|
| List jobs | listJobs, getJob, getApplicationForm |
| List jobs and accept applications | All of the above, plus uploadFile and submitApplication |
A list-only key calling uploadFile or submitApplication gets 403 ERR_FORBIDDEN.
Allowed websites
A key can be limited to up to ten websites, such as https://www.example.com. When a browser on any other website uses it, FindNeo refuses the call with 403 ERR_FORBIDDEN. Browsers send the page's address in the Origin header, and FindNeo checks it against the list.
Calls from a server send no Origin and are not checked. A key with no websites listed works from anywhere.
The key is not a password
A website that lists jobs from the browser puts the key in the page, where anyone can read it. That is expected: a key can only read what the public career page already shows, and send applications the way the career page does. What keeps it in check:
- its access (list only, or also applications);
- its allowed websites;
- the rate limits;
- revoking it.
Still, keep it out of public code repositories, and give each website its own key so you can revoke one without breaking the others.
Revoking a key
An admin revokes a key under Settings → Security & Access → API keys, in the key's ⋯ menu. It stops working at once and can't be turned back on. Calls with it answer 401 ERR_UNAUTHENTICATED. To replace a key, create the new one, switch your website to it, then revoke the old one.