Authentication

The Universal API supports two alternative authentication methods. Your integration uses only one: the one Blacktrust defines with you at the contract level. Along with your contract you receive only the credentials for that method.

One or the other, never both

On each request, send a single authentication mechanism: either the x-api-key header or the Authorization: Bearer header. There is no need (nor is it recommended) to combine them.

---

Which one is mine?

If Blacktrust gave you…	Your method is…	What you send on each request	Guide
An API Key	API Key	x-api-key: {apiKey}	API Key
An email and a password	Username and password (Bearer token)	Authorization: Bearer {accessToken}	Sign In

If you are not sure which one applies to you, check with your Blacktrust sales contact.

---

How each method works

API Key

No prior step is required: send your apiKey in the x-api-key header from the very first request.

curl -X GET "{BASE_URL}/candidate-requests/{uuid}" \
     -H "x-api-key: {apiKey}" \
     -H "Content-Type: application/json"

See the API Key guide →

Username and password (Bearer)

First obtain a token with POST /signin, then send it in the Authorization header of every request.

# 1. Get the token
curl -X POST "{BASE_URL}/signin" \
     -H "Content-Type: application/json" \
     -d '{"email": "user@client.com", "password": "your_secure_password"}'

# 2. Use the accessToken you received
curl -X GET "{BASE_URL}/candidate-requests/{uuid}" \
     -H "Authorization: Bearer {accessToken}" \
     -H "Content-Type: application/json"

See the Sign In guide →

---

Switching methods

The authentication method is configured at the contract level. If you need to change it, or rotate your credentials, request it through your sales contact.