Findwork Authentication: API Key Setup and Security (2026)

Authentication overview

Findwork secures access to its Job Search API and Job Feed API through API key authentication. This method requires developers to obtain a unique alphanumeric key from their Findwork developer dashboard and include it in the Authorization header of every request made to the API. This standard practice for RESTful APIs ensures that requests originate from an authenticated source and helps prevent unauthorized data access or quota abuse.

The Findwork API supports a straightforward authentication model designed for ease of integration while maintaining security. Developers can manage their API keys, including generation and revocation, directly within their Findwork account settings. The authentication process is consistent across all API endpoints, simplifying development workflows for applications embedding job search functionalities, building custom job boards, or aggregating job listings.

Proper management and protection of API keys are critical for maintaining the security and integrity of applications interacting with Findwork. Adherence to security best practices, such as never hardcoding keys and using environment variables, is recommended to prevent unauthorized access to job data.

Supported authentication methods

Findwork primarily utilizes API keys for authentication. This method is a common approach for securing access to web services, offering a balance between security and ease of implementation. An API key acts as a secret token that an application provides when making requests to the API, allowing the API to identify the calling application and verify its authorization. Findwork's implementation uses the Bearer token scheme, a widely adopted standard for transmitting tokens in HTTP requests.

The API key must be sent in the Authorization header with the Bearer prefix for all requests. This mechanism is defined within RFC 6750, which specifies the use of Bearer tokens for HTTP authentication schemes RFC 6750 Bearer Token Usage. This method is suitable for server-to-server communication and applications where the API key can be securely stored and managed.

While API keys are effective for identifying and authorizing client applications, they differ from other authentication methods like OAuth 2.0, which provides delegated authorization. For Findwork's scope of providing job data, direct API key authentication is sufficient and streamlined Findwork API documentation.

Getting your credentials

To access the Findwork API, you need an API key. This key serves as your primary credential for authenticating requests. The process for obtaining your API key is straightforward and managed through the Findwork developer dashboard.

1. Create a Findwork Account: If you do not already have one, register for a developer account on the Findwork homepage. This account will provide access to the developer dashboard where API keys are managed.
2. Navigate to the Developer Dashboard: Log in to your Findwork account. You should find a section or tab typically labeled "API Keys" or "Developer Settings" within the dashboard interface.
3. Generate a New API Key: Within the API Keys section, there will be an option to generate a new API key. Click this button to create a unique key for your application. Some platforms allow you to name your keys for easier management, especially if you plan to use multiple keys for different projects or environments.
4. Copy Your API Key: Once generated, your API key will be displayed. It is crucial to copy this key immediately and store it securely. For security reasons, Findwork may only show the full key once, similar to how many services handle secret keys. If you lose your key, you may need to generate a new one and revoke the old one.
5. Understand Usage Limits: Be aware of the Findwork API pricing page, which outlines the free tier (500 API calls/month) and paid plans. Your API key usage will be tracked against these limits.

It is recommended to generate separate API keys for different environments (e.g., development, staging, production) or for distinct applications. This practice enhances security by limiting the blast radius if a key is compromised and simplifies key rotation and revocation processes.

Authenticated request example

Once you have obtained your API key, you can use it to make authenticated requests to the Findwork API. The key must be included in the Authorization header of your HTTP request, prefixed with Bearer.

Here are examples of how to include your API key in requests using common programming languages and tools:

cURL Example

This cURL command demonstrates a basic GET request to the Findwork Job Search API, including the API key in the header:

curl -X GET \
  'https://findwork.dev/api/jobs?search=software+engineer&location=new+york' \
  -H 'Authorization: Bearer YOUR_FINDWORK_API_KEY' \
  -H 'Accept: application/json'

Python Example

Using the requests library in Python, you can construct an authenticated request as follows:

import requests
import os

API_KEY = os.getenv('FINDWORK_API_KEY')
if not API_KEY:
    raise ValueError("FINDWORK_API_KEY environment variable not set")

headers = {
    'Authorization': f'Bearer {API_KEY}',
    'Accept': 'application/json'
}

params = {
    'search': 'data scientist',
    'location': 'san francisco'
}

response = requests.get('https://findwork.dev/api/jobs', headers=headers, params=params)

if response.status_code == 200:
    print(response.json())
else:
    print(f"Error: {response.status_code} - {response.text}")

JavaScript (Fetch API) Example

For client-side or Node.js applications using the Fetch API:

const API_KEY = process.env.FINDWORK_API_KEY; // Or retrieve securely in client-side

if (!API_KEY) {
    console.error("FINDWORK_API_KEY environment variable not set");
    // Handle error appropriately
}

async function fetchJobs() {
  try {
    const response = await fetch('https://findwork.dev/api/jobs?search=web+developer&location=remote', {
      method: 'GET',
      headers: {
        'Authorization': `Bearer ${API_KEY}`,
        'Accept': 'application/json'
      }
    });

    if (!response.ok) {
      throw new Error(`HTTP error! status: ${response.status}`);
    }

    const data = await response.json();
    console.log(data);
  } catch (error) {
    console.error('Failed to fetch jobs:', error);
  }
}

fetchJobs();

In all examples, replace YOUR_FINDWORK_API_KEY with your actual API key, ideally retrieved from a secure environment variable or configuration service rather than hardcoding it directly in your source code.

Security best practices

Securing your Findwork API keys is essential to protect your application and prevent unauthorized access to job data or potential abuse of your API quota. Adhering to established security best practices for API keys is critical for any integration.

1. Do Not Hardcode API Keys: Never embed your API keys directly into your source code. Hardcoding keys makes them vulnerable to exposure if your code repository is compromised or accidentally made public. Instead, use environment variables, configuration files, or secret management services to store and retrieve keys at runtime. For example, using os.getenv() in Python or process.env in Node.js is a common and recommended practice.
2. Use Environment Variables: Store API keys as environment variables on your server or deployment platform. This keeps them separate from your codebase and allows for easier rotation without code changes.
3. Utilize Secret Management Services: For more complex deployments or enterprise applications, consider using dedicated secret management services like AWS Secrets Manager AWS Secrets Manager documentation, Google Cloud Secret Manager Google Cloud Secret Manager overview, or Azure Key Vault Azure Key Vault general overview. These services provide secure storage, fine-grained access control, and audit capabilities for sensitive credentials.
4. Restrict Access to API Keys: Limit who has access to your API keys. Only developers or systems that absolutely require access should be granted it. Implement strong access controls for your development environment, version control system, and deployment pipelines.
5. Implement IP Whitelisting (if available): Although Findwork's documentation does not explicitly mention IP whitelisting as of the current review, if such a feature becomes available, configure your API keys to only accept requests from a predefined list of trusted IP addresses. This adds an extra layer of security by preventing unauthorized access even if a key is stolen.
6. Monitor API Usage: Regularly monitor your Findwork API usage through your developer dashboard. Unusual spikes in activity or requests from unexpected locations could indicate a compromised key. Set up alerts if the dashboard offers such functionality.
7. Rotate API Keys Regularly: Periodically generate new API keys and revoke old ones. This practice, known as key rotation, minimizes the impact of a compromised key by reducing the window of vulnerability. The frequency of rotation depends on your security policies and risk assessment.
8. Revoke Compromised Keys Immediately: If you suspect an API key has been compromised, revoke it immediately from your Findwork developer dashboard. Then, generate a new key and update your applications accordingly.
9. Secure Client-Side Implementations: If you are using Findwork in a client-side application (e.g., a mobile app or a single-page application), be extremely cautious. Exposing API keys directly in client-side code is generally discouraged as they can be easily extracted. For such scenarios, consider using a backend proxy that authenticates with Findwork on behalf of your client, adding an extra layer of security.

By following these best practices, you can significantly reduce the risk of unauthorized access and ensure the secure operation of your applications relying on the Findwork API.