# Create a safe API key

Give another system only the Mjhr access it needs, then keep the token private.

Canonical URL: https://help.mjhr.ai/api-authentication
Machine-readable page: https://help.mjhr.ai/api-authentication/README.md
Full help context: https://help.mjhr.ai/llms-full.txt
Audience: Developers

## Before you create a key

Create API keys from the dashboard integration settings. Each key belongs to one workspace, so the key can only access data from that workspace.

Copy the generated token when it is shown and store it in a server-side secret manager. Do not place it in browser code, client-side config, generated files, or chat logs.

- Know which workspace the integration should read from.
- Choose the smallest set of scopes needed for the job.
- Name the key after the system or workflow that will use it.
- Plan how you will rotate or revoke the key if access changes.

## Choose access

- Workspace read: lets the integration confirm workspace identity, plan, and usage.
- Searches read: lets it list saved searches and fetch one saved search.
- Searches write: lets it submit new saved searches through the public API.
- Results read: lets it read companies first, then branches through the nested results endpoints.
- Results write: lets it move a result set to a folder or archive that result set.
- Folders read: lets it list search-history folders.
- Folders write: lets it create and archive folders, including archiving the searches inside a folder.

Note: Read-only agents usually need workspace read, searches read, results read, and folders read. Add write scopes only when the user expects the tool to create searches, move/archive result sets, or create/archive folders.

## Send requests securely

Send the token on each request with the Authorization header.

### Authorization header

```http
Authorization: Bearer <API_KEY>
```

## Allowed origins

API keys can be restricted by allowed origins. Server-side integrations usually do not need a browser origin. Browser-facing tools should call your backend first so the API key stays private.