Skip to main content
Server-to-server API key All protected JobHandy operations require an API key in the X-API-Key header. GET /health is the only public operation.
Need a credential? Follow API Key Management before continuing.

Send the API key

Select a tenant

An API key may include one or more tenants. Where documented, X-Tenant-ID selects one tenant that is already inside the key’s scope.
X-Tenant-ID never grants access. It only narrows the scope already assigned to the key.

Authentication flow

Credential failures

Credential handling rules

Secret storage

Store the key in a managed secret store or protected environment variable. Restrict read access to the integration runtime.
Never log the complete key. Log the returned X-Request-ID, operation, status, error code, and a non-secret internal credential label.
Create and verify a replacement key before deactivating the old credential. See Rotate API keys.
Do not expose the key to browser code, mobile applications, shared workstations, or customer-controlled scripts.
Last modified on August 28, 2026