Authentication
Authenticate to the RemakeCV API with a bearer API key. Keys are company-scoped, stored hashed, can be given an expiry, and are revocable at any time.
Send your API key as a bearer token in the Authorization header. Company administrators create and revoke keys themselves in Company Settings under Public API. Keys are scoped to one company and stored hashed, so the secret is shown only once at creation.
How do I authenticate?
curl "https://app.remakecv.com/api/public/v1/templates?acting_user_email=consultant@agency.com" \
-H "Authorization: Bearer $REMAKECV_API_KEY"The header must be exactly Authorization: Bearer <key>. A missing or malformed header returns 401 unauthorized.
How do I get a key?
Self-serve, if you are a company administrator.
Open Company Settings → Public API
The tab appears only for administrators.
Enable the public API
It is off by default.
Create a named key
Give it a name identifying the integration. The secret is displayed once — copy it immediately, because it cannot be shown again.
Revoke keys you no longer need
Revocation takes effect immediately; requests with that key start failing at once.
Keys look like rcv_ followed by 48 hex characters. The table shows each key's name, prefix, status and when it was last used.
Some settings are not self-serve: the rate limit, the maximum file size, the API's default template, and key expiry dates. Email support@remakecv.com for those.
What is the acting user, and when is it required?
acting_user_email identifies the consultant a request is on behalf of. It is required on two endpoints only:
| Endpoint | Acting user |
|---|---|
POST /cvs/process | Required |
GET /templates | Required |
GET /cvs, GET /cvs/{cvId}, GET /cvs/{cvId}/file | Not used — scoped by company |
Where it applies, it is not metadata. It determines:
- Which templates are visible. Template visibility can be scoped to specific users.
- Which credit limits apply. Per-user limits and shared pools are checked against this address.
- What appears in usage logs. Credit usage is attributed to this user.
Pass the real consultant's email, not a shared service account. Routing every API call through one address collapses your per-user credit limits into a single bucket and makes usage reporting meaningless.
How are keys stored?
Keys are never stored in plain text. RemakeCV holds a SHA-256 lookup hash for fast retrieval and a bcrypt hash for verification. This is why a key cannot be shown again after creation — if it is lost, create a new one and revoke the old.
Each key records last_used_at, which is how you spot a key still in use after you thought it was retired.
What can go wrong?
| Status | Code | Meaning |
|---|---|---|
401 | unauthorized | Authorization header missing or malformed |
401 | invalid_api_key | Key not found, revoked, inactive or expired |
403 | api_disabled | The public API is not enabled for this company |
404 | company_not_found | The key's company no longer exists |
400 | acting_user_required | acting_user_email was not supplied |
404 | acting_user_invalid | The acting user is not a member of this company |
How should I handle keys securely?
Server-side only
Never put an API key in browser JavaScript, a mobile app, or any client you do not control. It grants access to candidate personal data.
Use environment variables
Not source code. A key committed to a repository is a key that has leaked, even in a private repo.
One key per integration
Separate keys per system mean you can revoke one without breaking the others, and
last_used_attells you which is which.Revoke on offboarding
When someone who held a key leaves, revoke it yourself from Company Settings → Public API. It stops working immediately.
Where do keys sit in the wider API?
Authentication is the first of four things every integration must handle. The others are rate limits, errors, and choosing a template — see the API introduction for the whole picture.
How do I rotate a key?
Create a new key, deploy it, confirm traffic has moved by checking that the old key's last_used_at has stopped advancing, then revoke the old one. A company can hold several active keys, so there is no downtime.
Frequently asked questions
- How do I get an API key?
- A company administrator creates one in Company Settings under Public API. Enable the API, create a named key, and copy the secret — it is shown only once.
- What happens if a key leaks?
- Revoke it yourself from Company Settings → Public API. Revocation is immediate. Then create a replacement — keys carry access to candidate personal data.
- Do I need an acting user on every request?
- No. Only POST /cvs/process and GET /templates use acting_user_email. The CV listing and file endpoints are scoped by company alone.
Related articles
Last updated . Still stuck? Email support@remakecv.com or book a call.