Keys, limits & errors
Scoped API keys, test vs live, rate limits, error codes, pagination and ETags.
API reference
37 endpoints with curl and TypeScript examples, plus the OpenAPI 3.1 file.
Webhooks
Signed, retried events for applications, offers, assessments, interviews and postings.
Embeds
Job board, employer grade, verified badge, apply button and profile card. One script tag.
JavaScript SDK
@one-career/sdk: typed, zero dependencies, pagination, retries and webhook verification.
Portfolio themes
Design your own portfolio theme with verified data and publish it to the gallery.
Quickstart (5 minutes)
- An organisation admin opens Organisation console → Developers and creates a test key (
oc_test_…). Copy it now, because it is shown only once. - Call the API from your server:
curl https://one-career.com/api/v1/org \
-H "Authorization: Bearer $ONE_CAREER_API_KEY"npm install @one-career/sdk
import { OneCareer } from "@one-career/sdk";
const oc = new OneCareer({ apiKey: process.env.ONE_CAREER_API_KEY });
const { data: postings } = await oc.postings.list({ status: "open" });
for await (const app of oc.applications.all({ stage: "screening" })) console.log(app.id, app.match_score);- Add a webhook to hear about new applications as they happen (guide).
- Show your open roles on your careers page with no key and no backend:
<script src="https://one-career.com/embed/v1.js" async></script>
<oc-jobs org="your-org-slug"></oc-jobs>How the platform protects people
- Same rules as the app. A key acts as the admin who created it. Every hiring rule, OC-Reveal mask and Trust & Safety restriction applies. If that admin leaves, the key stops working.
- Consent first. Candidate names and contact details stay hidden until the candidate shares them with you. Documents and salary history are never available through the API. Profile cards are shared by candidates themselves and can be revoked at any time.
- No personal data in webhooks. Events carry IDs and changed fields only. Fetch details with your key.
- Hashed secrets. API keys are stored as peppered SHA-256 hashes and webhook secrets are encrypted. Neither can be shown again.