Authentication

Every request to the Partner API must include an API key.

Environments

The Partner API has two environments. Build and test against staging, then switch to
production when you go live.

Each environment has its own API key. A key works only in the environment it was issued
for: a staging key sent to production, or a production key sent to staging, is rejected with
403 {"message": "Forbidden"}.

Getting a key

Partner API keys are issued by request — reach out to your Apploi contact or
[email protected] to get one. Tell us whether you need a
staging key, a production key, or both. There is currently no self-service way to
generate a key.

We refresh the staging environment from time to time, so a staging key may occasionally
stop working. If that happens, ask us for a new one.

Sending your key

Send your key in the X-Api-Key header on every request:

curl https://partners.apploi.com/applicants \
  -H "X-Api-Key: YOUR_API_KEY"

import requests

response = requests.get(
    "https://partners.apploi.com/applicants",
    headers={"X-Api-Key": "YOUR_API_KEY"},
)

const response = await fetch("https://partners.apploi.com/applicants", {
  headers: { "X-Api-Key": "YOUR_API_KEY" },
});

require "net/http"
require "uri"

uri = URI("https://partners.apploi.com/applicants")
request = Net::HTTP::Get.new(uri)
request["X-Api-Key"] = "YOUR_API_KEY"

response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: true) do |http|
  http.request(request)
end

These examples call production. To call staging, use https://partner-api-staging.apploi.com
as the base URL with your staging key.

Testing in the API reference

Every page in the API Reference has a Try It panel that sends real requests.

1. Under URL, choose Production or Staging from the Base URL dropdown.
   Production is selected by default.
2. Enter the key for that environment in the x-api-key field.
3. Switching the base URL doesn't switch the key. The field keeps whatever you typed, so
   paste in the other environment's key each time you switch.

The code samples next to the panel update to match the base URL you picked.

Using the SDKs against staging

Pass the staging base URL when you create the client, along with your staging key:
baseUrl: "https://partner-api-staging.apploi.com" in TypeScript, or
base_url="https://partner-api-staging.apploi.com" in Python. Leave it unset to use
production.

Deprecated: Authorization: Bearer and /v1/users/login

Some parts of the API — the /easy-apply endpoint and POST /v1/users/login — also
accept an Authorization: Bearer <token> header, using a token obtained from either
endpoint's own response. This flow is deprecated and being sunset. New integrations
should authenticate with X-Api-Key instead. If you're still using the bearer-token flow,
plan to migrate — watch for a follow-up communication with removal timelines.

Authentication failures

See Errors & Troubleshooting for the full
status-code catalog, including how to tell the different 403 cases apart.