Authentication

Every request to the Curriculo API carries your Developer Console key as a bearer token:

Authorization: Bearer key_<id>_<secret>

curl -X POST https://api.curriculo.me/public/detect-language/ \
  -H 'Authorization: Bearer key_abc123_yoursecret' \
  -H 'Content-Type: application/json' \
  -d '{"text": "Ingeniera de software con diez años de experiencia"}'

One key, every operation

A Console key works for every operation the moment it is created. There are no per-endpoint credentials, no scopes and no per-capability request. There is no ATS login, no session cookie and no organisation header involved.

Getting API keys

Sign in to the Developer Console and open API keys.

• Each key can carry a name and an optional expiry. A key without an expiry works until you revoke it.
• The plaintext value is returned once, at creation. Only a 16-character prefix and a SHA-256 hash are stored, so a lost key is replaced, never recovered.
• Revocation is immediate. The next request with a revoked key gets 401.
• An account can hold up to 25 active keys.

What a key needs to serve traffic

A key is accepted when its account:

• has finished provisioning (this happens on first sign-in);
• has a prepaid credit balance above zero (new accounts start with a $5.00 free credit);
• is not suspended.

Key hygiene

Treat an API key like a password. Never commit it to source control or paste it into an untrusted client, and revoke it as soon as it is exposed.

• Issue separate keys per environment or team to keep usage attributable and each key independently revocable.
• Keys are scoped to your organisation and see nothing else.
• A key cannot manage the account. It cannot mint keys or change billing, so a leaked key can never escalate into account control.

Authentication errors

See Errors for the full list.