Authentication
The Universal API supports two alternative authentication methods. Your integration uses only one: the one Blacktrust defines with you at the contract level. Along with your contract you receive only the credentials for that method.
On each request, send a single authentication mechanism: either the x-api-key header or the Authorization: Bearer header. There is no need (nor is it recommended) to combine them.
Which one is mine?
| If Blacktrust gave you… | Your method is… | What you send on each request | Path prefix | Guide |
|---|---|---|---|---|
| An API Key | API Key | x-api-key: {apiKey} | /services | API Key |
| An email and a password | Username and password (Bearer token) | Authorization: Bearer {accessToken} | None | Sign In |
With an API Key, the available endpoints carry the /services prefix (for example, /services/candidate-requests). With username and password they are used without a prefix (/candidate-requests). The documentation shows paths without the prefix.
If you are not sure which one applies to you, check with your Blacktrust sales contact.
How each method works
- API Key
- Username and password (Bearer)
No prior step is required: send your apiKey in the x-api-key header from the very first request.
curl -X GET "{BASE_URL}/services/candidate-requests/{uuid}" \
-H "x-api-key: {apiKey}" \
-H "Content-Type: application/json"
First obtain a token with POST /signin, then send it in the Authorization header of every request.
# 1. Get the token
curl -X POST "{BASE_URL}/signin" \
-H "Content-Type: application/json" \
-d '{"email": "user@client.com", "password": "your_secure_password"}'
# 2. Use the accessToken you received
curl -X GET "{BASE_URL}/candidate-requests/{uuid}" \
-H "Authorization: Bearer {accessToken}" \
-H "Content-Type: application/json"
Switching methods
The authentication method is configured at the contract level. If you need to change it, or rotate your credentials, request it through your sales contact.