Authentication

Create and revoke keys on the dashboard API keys page. Keys look like sk_skillflare_... and are scoped to your organization.

Send the key on every org request:

curl https://api.skillflare.co/v1/candidates \
  -H "x-api-key: sk_skillflare_YOUR_KEY"

CORS

The API allows cross-origin browser calls with headers including x-api-key, x-organization-id and content-type. Allowed methods: GET, POST, PATCH, OPTIONS.

Partner keys

This subsection applies only to partner customers. See Organizations.

A key bound to a partner organization can act on a direct child organization. Pass that child with the optional x-organization-id header on candidate, challenge, and session requests. Omit the header to use the organization that owns the API key. See Candidates, Challenges, and Sessions.

An unknown organization returns 404. An organization the key cannot access returns 403. A non-empty organization_id in the query or JSON body returns 400 VALIDATION_ERROR with message organization_id is not accepted; pass the client organization with the x-organization-id header. Blank or omitted values are ignored.

A key created for a child is scoped to that child alone. Client keys cannot call the Organizations routes.