Authentication
API keys for systems, OAuth for people's AI clients, and which to use when.
Rolling out
API keys are available to selected organizations while they roll out. If you don't see Developers in Settings, ask the Invyte team to turn API keys on for your organization.
| You are building | Use | How it authenticates |
|---|---|---|
| An integration, script or scheduled job | API key | Authorization: Bearer ink_live_… |
| A way for a person to use Invyte from their AI client | Recruiter MCP | OAuth sign-in as that person |
API keys
Send the key in the Authorization header on every request:
curl https://www.invyte.ai/api/recruiter/v1/operations -H "Authorization: Bearer $INVYTE_API_KEY"- Keys belong to the organization, not a person, so they keep working when the person who made one leaves.
- Each key holds a role at organization, Client or Job scope, and can do only what that role allows.
- Keys are accepted only in the
Authorizationheader. A key in a URL or request body is refused.
OAuth (AI clients)
The Recruiter MCP runs OAuth for you: the person signs in, approves the client, and the client acts as them. Tokens are short-lived and bound to the MCP server, so you never handle them yourself.
Failures
A missing, wrong, expired or revoked key gets the same 401 unauthorized. A valid key without permission for an
operation gets 403 forbidden or 404 not_found. See Errors.