Cutshort API Authentication – API Keys & Bearer Tokens

The Cutshort API uses API key authentication. Every request must include your API key as a Bearer token in the Authorization header. Keys are scoped to your Cutshort organization and carry full API permissions, so handle them with care.

Getting your API key

Open your API Keys settings

Create a new key

Click New API Key and enter a descriptive name that identifies where the key will be used (for example, Production ATS or Staging Integration).

Copy and store your key

Copy the key immediately and store it in a secure location. Cutshort only displays the full key once — if you lose it, you will need to generate a new one.

Using your API key

Include the following headers on every API request:

Authorization: Bearer YOUR_API_KEY
Content-Type: application/json

The examples below show how to add this header in common HTTP clients:

curl -X GET 'https://api.cutshort.io/v1/candidates/search' \
  -H 'Authorization: Bearer YOUR_API_KEY' \
  -H 'Content-Type: application/json'

import requests

api_key = "YOUR_API_KEY"

headers = {
    "Authorization": f"Bearer {api_key}",
    "Content-Type": "application/json"
}

response = requests.get(
    "https://api.cutshort.io/v1/candidates/search",
    headers=headers
)

const apiKey = "YOUR_API_KEY";

const response = await fetch("https://api.cutshort.io/v1/candidates/search", {
  method: "GET",
  headers: {
    "Authorization": `Bearer ${apiKey}`,
    "Content-Type": "application/json"
  }
});

const data = await response.json();

Managing API keys

Create multiple keys — for example, one per environment (development, staging, production) — to keep activity logs clean and limit blast radius if a key is compromised.
Revoke any key at any time from Settings → Integrations → API Keys in your dashboard.
Key deletion is immediate and irreversible — any requests using a deleted key will return 401 Unauthorized instantly.
All API activity is logged per key, giving you a clear audit trail of which integration made each request.

Authentication errors

Error Code	Meaning	Action
`401 Unauthorized`	Missing or invalid API key	Check that your key is correct and included in the `Authorization` header
`403 Forbidden`	Valid key but insufficient permissions	Verify that your Cutshort plan includes API access
`429 Too Many Requests`	Rate limit exceeded	Implement exponential backoff and retry; see Rate Limits

Never expose your API key in client-side JavaScript, browser requests, or public repositories. If a key is accidentally exposed, revoke it immediately from your dashboard and generate a replacement.

Get Started

Core Concepts

Guides

MCP Server

Cutshort API Authentication – API Keys & Bearer Tokens

Getting your API key

Using your API key

Managing API keys

Authentication errors

​Getting your API key

​Using your API key

​Managing API keys

​Authentication errors

Getting your API key

Using your API key

Managing API keys

Authentication errors