API Key Authentication

Is this your method?

Use this guide if Blacktrust gave you an API Key. If it gave you an email and a password, your method is Sign In (Bearer). The two methods are alternatives: see the Authentication overview.

Blacktrust issues an API Key for each client to consume the Universal API. This credential identifies your integration and determines the packages and Processes you have access to. With this method you do not need to call /signin: you send the API Key from the very first request.

---

Credential

Credential	Description
API Key	Identifier of your integration. It must be sent in all API requests using the x-api-key header.

---

Required Header (HTTP Header)

Header	Type	Required	Value / Example
x-api-key	string	Yes	{apiKey}

---

Request Example

cURL

curl -X GET "{BASE_URL}/candidate-requests/8b9cad0e-1f20-4192-bff0-e1e043cea4db" \
     -H "x-api-key: {apiKey}" \
     -H "Content-Type: application/json"

Node.js

const response = await fetch(
  "{BASE_URL}/candidate-requests/8b9cad0e-1f20-4192-bff0-e1e043cea4db",
  {
    method: "GET",
    headers: {
      "x-api-key": apiKey,
      "Content-Type": "application/json",
    },
  },
);

Credential Issuance

The API Key is issued by the Blacktrust sales team and configured at the contract level. If you do not have one yet, or need to rotate it, request it through your sales contact.

Confidentiality

Do not expose these credentials in client-side code (browsers or mobile apps), code repositories, or screenshots. All requests must originate from your server.