Authentication

Two ways in: an API key for your code and coding tools, OAuth sign-in for AI apps.

API keys#

Send your key on every request, either way:

http
Authorization: Bearer mjd_live_…
# or
x-api-key: mjd_live_…
  • Create and revoke keys on the API keys page. Up to 10 active keys per account.
  • A key is shown once. We store only a hash of it, so a lost key cannot be recovered; make a new one.
  • Keys start with mjd_live_ and carry a checksum, so a mistyped key is refused instantly.
  • A revoked key stops working within a minute on every server.
Keep keys server-side
Anyone with a key can spend your request limit. Don’t ship it in a browser or mobile app; call the API from your server.

OAuth (ChatGPT, Claude and other AI apps)#

AI apps cannot paste a key, so they sign you in instead. You add https://jobs-api.arihaan.ai/mcp as a connector, the app opens our sign-in page, you continue with Google and click Allow. The app receives a token that works like a key for your account.

  • OAuth 2.1 with PKCE. Clients register themselves (dynamic client registration) or use a Client ID Metadata Document.
  • Discovery: /.well-known/oauth-protected-resource/mcp and /.well-known/oauth-authorization-server.
  • Access tokens last 1 hour and refresh automatically for 30 days.
  • See and disconnect connected apps on the API keys page.