Reading jobs is public. Write operations (applying to a job, creating a
job) require an API key, sent in the x-api-key header.
An API key is scoped to a user. Applying uses that user’s profile and active
resume; creating requires recruiter permissions on the key’s account.
Keep API keys server-side. Never embed a key in client-side code or a public
page. A missing or invalid key returns 401 unauthenticated (see
Errors).