Authentication

Authenticate every request with a personal access token in the Authorization header. Tokens are created in Settings → API Access while you're signed in.

http
Authorization: Bearer il_pat_…

Token lifetime

  • Every token expires. Choose 7, 30 (default), or 90 days; there are no non-expiring tokens.
  • You can have up to 10 active tokens. Create one per agent so you can revoke them independently.
  • Revocation is immediate. Revoke in Settings, or have the agent revoke its own token with DELETE /api/v1/tokens/self.
  • Settings shows when each token was last used.

One access level, enforced by your plan

Every token can do the same things: read and update your profile's default resume, create and update opportunities and interviewers, and request intelligence generation. What a request actually unlocks is decided by your plan, which our servers check on every request:

  • Free: personalize 1 opportunity and 2 interviewers; summary, role in decision, focus areas and likely questions.
  • Pro: 10 active opportunities × 10 interviewers, plus positioning, experiences to highlight, red flags, questions to ask, and Gap Radar.

Over a limit you get a clear error (for example 403 INTERVIEWER_LIMIT_REACHED with upgradeUrl), never a partial result. Plan changes apply to existing tokens immediately.

What tokens can't do

Tokens work only on /api/v1. They can't create, list, or revoke other tokens, manage billing, or reach any other part of the app. Those always require you to be signed in.

Keeping tokens safe

  • Store the token in your agent's secret settings or an environment variable, never in prompts, notes, or code you share.
  • Create a separate token per agent, so one can be revoked without breaking the others.
  • If a token may have leaked, revoke it right away. Leaked tokens stop working on the next request.