How do I create an account on USAJOBS?

You can create a USAJOBS account by visiting the USAJOBS.gov homepage and selecting 'Create an account.' You'll need to provide an email address, create a username and password, and verify your email.

Is multi-factor authentication (MFA) required for USAJOBS?

MFA is highly recommended for individual USAJOBS accounts to enhance security, but it is typically optional. Enabling it adds a second verification step to your login process.

How do developers get an API key for USAJOBS?

Developers can obtain an API key by visiting the USAJOBS Data Services Portal, creating an account if necessary, and following the instructions to request a key for programmatic access.

Where should I store my USAJOBS API key securely?

API keys should be stored securely, ideally using environment variables or a dedicated secret management service. Avoid hardcoding them directly into your application's source code or committing them to version control.

Can I use the USAJOBS API without an API key?

No, programmatic access to the USAJOBS API requires a valid API key, which serves as your credential for making authenticated requests.

What is the 'Host' header requirement for USAJOBS API requests?

The 'Host' header, set to 'data.usajobs.gov', is a mandatory header that must be included in all USAJOBS API requests to correctly route and process your query.

USAJOBS Authentication: Secure Access & API Integration

Q: What security standards does USAJOBS follow?

USAJOBS operates under federal security guidelines and is compliant with the Federal Information Security Modernization Act (FISMA), ensuring specific controls are in place to protect government information.

Authentication overview

USAJOBS provides authentication mechanisms for both individual users accessing the web portal and developers integrating with the USAJOBS API. For individual users, authentication secures personal information, application history, and saved searches within their USAJOBS account. For developers, authentication grants access to the USAJOBS public API, allowing programmatic retrieval of federal job listings and related data.

The system is owned by the United States Office of Personnel Management (OPM) and operates under federal security guidelines, including compliance with the Federal Information Security Modernization Act (FISMA). This compliance mandates specific security controls and practices to protect government information and systems.

Supported authentication methods

USAJOBS supports distinct authentication methods for different user types:

Web Portal Users (Individuals): Primarily use a username and password. Multi-factor authentication (MFA) is available and recommended for enhanced account security. This typically involves a second verification step, such as a code sent to a mobile device.
API Users (Developers): Access the USAJOBS API using an API key. This key serves as a unique identifier and credential, allowing authorized applications to make requests and retrieve data.

Authentication methods table

Method	When to Use	Security Level
Username/Password	Accessing USAJOBS.gov website, managing applications, building resumes.	Standard, foundational.
Multi-Factor Authentication (MFA)	Optional for web portal users, adds an extra layer of security beyond username/password.	Enhanced, recommended for all users.
API Key	Programmatic access to the USAJOBS API for integrating job data into external applications.	Specific to API access, secures application-to-application communication.

Getting your credentials

For web portal users (USAJOBS.gov account)

Account Creation: Navigate to the USAJOBS homepage and select "Create an account."
Information Submission: Provide required personal details, including a valid email address, and create a unique username and strong password.
Email Verification: USAJOBS will send a verification email to the address provided. Follow the instructions in the email to activate the account.
MFA Setup (Optional but Recommended): After successful login, users can enable MFA through their account settings. This typically involves registering a mobile device or authenticator app to receive time-based one-time passwords (TOTP) or SMS codes. The National Institute of Standards and Technology (NIST) provides detailed guidelines for digital identity, including recommendations for multi-factor authentication strength.

For API users (API Key)

Developers seeking to access the USAJOBS API need to obtain an API key. The process typically involves:

Visit the Data Portal: Go to the USAJOBS Data Services Portal.
Registration/Account Creation: You may need to create a separate account on the data portal if you don't already have one.
Request API Key: Follow the instructions on the portal to request an API key. This often involves agreeing to terms of service and providing information about your intended use of the API.
Key Retrieval: Once approved, your API key will be made available through the portal dashboard. This key should be treated as sensitive information.

The USAJOBS API reference provides comprehensive details on the structure of API requests and how to utilize the API key.

Authenticated request example

This example demonstrates how to make an authenticated request to the USAJOBS API using an API key. This assumes you have already obtained a valid API key from the USAJOBS Data Services Portal. The API key is typically passed in the Host header, as specified in the API documentation.

Example: Fetching job listings using cURL

curl --request GET \
  --url 'https://data.usajobs.gov/api/Search?Keyword=Software%20Engineer&Location=Washington%20DC' \
  --header 'Host: data.usajobs.gov' \
  --header 'User-Agent: YourAppName/1.0 ([email protected])' \
  --header 'Authorization: Bearer YOUR_API_KEY_HERE'

In this example:

--url specifies the API endpoint and search parameters.
--header 'Host: data.usajobs.gov' is a mandatory header.
--header 'User-Agent: YourAppName/1.0 ([email protected])' helps USAJOBS identify the application making the request.
--header 'Authorization: Bearer YOUR_API_KEY_HERE' is where your unique API key is inserted. Replace YOUR_API_KEY_HERE with your actual key.

Security best practices

Adhering to security best practices is crucial for protecting your USAJOBS account and any applications integrating with its API.

For web portal users

Enable Multi-Factor Authentication (MFA): Always enable MFA if available. This significantly reduces the risk of unauthorized access, even if your password is compromised.
Use Strong, Unique Passwords: Create passwords that are complex, combining uppercase and lowercase letters, numbers, and symbols. Avoid reusing passwords across different services. Password managers can assist in generating and storing strong, unique passwords.
Regularly Update Passwords: Change your USAJOBS password periodically, especially if you suspect any unauthorized activity.
Be Wary of Phishing Attempts: USAJOBS or OPM will not ask for your password via email. Be cautious of emails asking for personal information or credentials and always verify the sender. Check the URL for legitimacy before entering login details.
Log Out After Each Session: Always log out of your USAJOBS account, especially when using public or shared computers.
Monitor Account Activity: Regularly review your application history and profile information for any suspicious changes.

For API users

Protect Your API Key: Treat your API key as sensitive as a password. Do not hardcode it directly into your application's source code, commit it to version control systems like Git, or expose it in client-side code.
Use Environment Variables or Secret Management: Store API keys in environment variables or use a dedicated secret management service. This prevents the key from being exposed in your codebase and makes it easier to rotate.
Implement Secure Key Rotation: Periodically rotate your API keys to minimize the risk associated with a compromised key. The USAJOBS Data Services Portal should provide functionality for this.
Restrict API Key Permissions (if applicable): If the USAJOBS API allows for granular permissions, ensure your API key only has the minimum necessary access required for your application's function.
Monitor API Usage: Keep track of your API usage patterns. Unexpected spikes or unusual requests could indicate a compromised key.
Validate and Sanitize Inputs: Always validate and sanitize any user-provided input before using it in API requests to prevent injection attacks.
Secure Your Application: Ensure the application consuming the USAJOBS API is itself secure, following general web security best practices, including secure coding and dependency management.