> ## Documentation Index
> Fetch the complete documentation index at: https://developers.cutshort.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Cutshort API Authentication – API Keys & Bearer Tokens

> Generate a Cutshort API key, pass it as a Bearer token, manage keys across environments, and handle authentication errors like 401 and 403.

The Cutshort API uses API key authentication. Every request must include your API key as a Bearer token in the `Authorization` header. Keys are scoped to your Cutshort organization and carry full API permissions, so handle them with care.

## Getting your API key

<Steps>
  <Step title="Open your API Keys settings">
    Log in at [cutshort.io](https://cutshort.io), then navigate to **Settings → Integrations → API Keys**.
  </Step>

  <Step title="Create a new key">
    Click **New API Key** and enter a descriptive name that identifies where the key will be used (for example, `Production ATS` or `Staging Integration`).
  </Step>

  <Step title="Copy and store your key">
    Copy the key immediately and store it in a secure location. Cutshort only displays the full key once — if you lose it, you will need to generate a new one.
  </Step>
</Steps>

## Using your API key

Include the following headers on every API request:

```http theme={null}
Authorization: Bearer YOUR_API_KEY
Content-Type: application/json
```

The examples below show how to add this header in common HTTP clients:

<CodeGroup>
  ```bash curl theme={null}
  curl -X GET 'https://api.cutshort.io/v1/candidates/search' \
    -H 'Authorization: Bearer YOUR_API_KEY' \
    -H 'Content-Type: application/json'
  ```

  ```python Python theme={null}
  import requests

  api_key = "YOUR_API_KEY"

  headers = {
      "Authorization": f"Bearer {api_key}",
      "Content-Type": "application/json"
  }

  response = requests.get(
      "https://api.cutshort.io/v1/candidates/search",
      headers=headers
  )
  ```

  ```javascript Node.js theme={null}
  const apiKey = "YOUR_API_KEY";

  const response = await fetch("https://api.cutshort.io/v1/candidates/search", {
    method: "GET",
    headers: {
      "Authorization": `Bearer ${apiKey}`,
      "Content-Type": "application/json"
    }
  });

  const data = await response.json();
  ```
</CodeGroup>

## Managing API keys

* Create multiple keys — for example, one per environment (development, staging, production) — to keep activity logs clean and limit blast radius if a key is compromised.
* Revoke any key at any time from **Settings → Integrations → API Keys** in your dashboard.
* Key deletion is immediate and irreversible — any requests using a deleted key will return `401 Unauthorized` instantly.
* All API activity is logged per key, giving you a clear audit trail of which integration made each request.

## Authentication errors

| Error Code              | Meaning                                | Action                                                                                 |
| ----------------------- | -------------------------------------- | -------------------------------------------------------------------------------------- |
| `401 Unauthorized`      | Missing or invalid API key             | Check that your key is correct and included in the `Authorization` header              |
| `403 Forbidden`         | Valid key but insufficient permissions | Verify that your Cutshort plan includes API access                                     |
| `429 Too Many Requests` | Rate limit exceeded                    | Implement exponential backoff and retry; see [Rate Limits](/api-reference/rate-limits) |

<Warning>
  Never expose your API key in client-side JavaScript, browser requests, or public repositories. If a key is accidentally exposed, revoke it immediately from your dashboard and generate a replacement.
</Warning>