# Authentication

> Authenticate to the RemakeCV API with a bearer API key. Keys are company-scoped, stored hashed, can be given an expiry, and are revocable at any time.

Source: https://www.remakecv.com/help/api-reference/authentication
Last updated: 2026-08-21

---
Send your API key as a bearer token in the `Authorization` header. Company administrators create and revoke keys themselves in Company Settings under **Public API**. Keys are scoped to one company and stored hashed, so the secret is shown only once at creation.

## How do I authenticate?

```bash
curl "https://app.remakecv.com/api/public/v1/templates?acting_user_email=consultant@agency.com" \
  -H "Authorization: Bearer $REMAKECV_API_KEY"
```

The header must be exactly `Authorization: Bearer <key>`. A missing or malformed header returns `401 unauthorized`.

## How do I get a key?

Self-serve, if you are a company administrator.

### Open Company Settings → Public API

The tab appears only for administrators.

### Enable the public API

It is off by default.

### Create a named key

Give it a name identifying the integration. The secret is displayed **once** — copy it immediately, because it cannot be shown again.

### Revoke keys you no longer need

Revocation takes effect immediately; requests with that key start failing at once.

Keys look like `rcv_` followed by 48 hex characters. The table shows each key's name, prefix, status and when it was last used.

> **Note:** 
Some settings are **not** self-serve: the rate limit, the maximum file size, the API's default template, and key expiry dates. Email support@remakecv.com for those.

## What is the acting user, and when is it required?

`acting_user_email` identifies the consultant a request is on behalf of. It is required on **two endpoints only**:

| Endpoint | Acting user |
|---|---|
| [`POST /cvs/process`](https://www.remakecv.com/help/api-reference/endpoints/process-a-cv.md) | Required |
| [`GET /templates`](https://www.remakecv.com/help/api-reference/endpoints/list-templates.md) | Required |
| `GET /cvs`, `GET /cvs/{cvId}`, `GET /cvs/{cvId}/file` | Not used — scoped by company |

Where it applies, it is not metadata. It determines:

- **Which templates are visible.** Template visibility can be scoped to specific users.
- **Which credit limits apply.** Per-user limits and shared pools are checked against this address.
- **What appears in usage logs.** Credit usage is attributed to this user.

> **Warning:** 
Pass the real consultant's email, not a shared service account. Routing every API call through one address collapses your per-user credit limits into a single bucket and makes usage reporting meaningless.

## How are keys stored?

Keys are never stored in plain text. RemakeCV holds a SHA-256 lookup hash for fast retrieval and a bcrypt hash for verification. This is why a key cannot be shown again after creation — if it is lost, create a new one and revoke the old.

Each key records `last_used_at`, which is how you spot a key still in use after you thought it was retired.

## What can go wrong?

| Status | Code | Meaning |
|---|---|---|
| `401` | `unauthorized` | `Authorization` header missing or malformed |
| `401` | `invalid_api_key` | Key not found, revoked, inactive or expired |
| `403` | `api_disabled` | The public API is not enabled for this company |
| `404` | `company_not_found` | The key's company no longer exists |
| `400` | `acting_user_required` | `acting_user_email` was not supplied |
| `404` | `acting_user_invalid` | The acting user is not a member of this company |

## How should I handle keys securely?

### Server-side only

Never put an API key in browser JavaScript, a mobile app, or any client you do not control. It grants access to candidate personal data.

### Use environment variables

Not source code. A key committed to a repository is a key that has leaked, even in a private repo.

### One key per integration

Separate keys per system mean you can revoke one without breaking the others, and `last_used_at` tells you which is which.

### Revoke on offboarding

When someone who held a key leaves, revoke it yourself from Company Settings → Public API. It stops working immediately.

## Where do keys sit in the wider API?

Authentication is the first of four things every integration must handle. The others are [rate limits](https://www.remakecv.com/help/api-reference/rate-limits.md), [errors](https://www.remakecv.com/help/api-reference/errors.md), and choosing a [template](https://www.remakecv.com/help/api-reference/endpoints/list-templates.md) — see the [API introduction](https://www.remakecv.com/help/api-reference/introduction.md) for the whole picture.

## How do I rotate a key?

Create a new key, deploy it, confirm traffic has moved by checking that the old key's `last_used_at` has stopped advancing, then revoke the old one. A company can hold several active keys, so there is no downtime.

## Frequently asked questions

### How do I get an API key?

A company administrator creates one in Company Settings under Public API. Enable the API, create a named key, and copy the secret — it is shown only once.

### What happens if a key leaks?

Revoke it yourself from Company Settings → Public API. Revocation is immediate. Then create a replacement — keys carry access to candidate personal data.

### Do I need an acting user on every request?

No. Only POST /cvs/process and GET /templates use acting_user_email. The CV listing and file endpoints are scoped by company alone.