WhatJobs Authentication: Methods and Security Best Practices (2026)

Authentication overview

Authentication for WhatJobs provides mechanisms to verify the identity of a user or an application attempting to access platform resources. This verification process ensures that only authorized entities can perform actions such as posting job listings, retrieving candidate data, or managing user profiles. The choice of authentication method typically depends on the client type and the scope of access required. For direct programmatic interaction with the WhatJobs API, API keys are a common method, enabling server-to-server communication with predefined permissions. When integrating third-party applications or services that require delegated authorization from a user, WhatJobs utilizes the OAuth 2.0 framework, which allows users to grant specific permissions to applications without sharing their credentials directly. All interactions with WhatJobs APIs require secure transport layer security (TLS) to protect data in transit. This aligns with industry standards for securing web traffic and API communications, as detailed by organizations like the World Wide Web Consortium on web security.

The authentication process is a critical component of the overall security architecture, preventing unauthorized access and maintaining the integrity of data within the WhatJobs ecosystem. Proper implementation of authentication protocols is essential for developers building integrations or automated workflows with the platform. Developers are advised to consult the official WhatJobs API documentation on authentication for the most current and detailed instructions, including specific endpoint details and error handling for common authentication failures. This documentation provides comprehensive guidelines for setting up and managing credentials effectively.

Supported authentication methods

WhatJobs supports distinct authentication methods tailored for different integration scenarios:

• API Keys: These are unique identifiers used to authenticate an application or user to the WhatJobs API. API keys are typically long, randomly generated strings that are passed with each request, usually in a header (e.g., Authorization: Bearer YOUR_API_KEY) or as a query parameter. They grant access based on the permissions assigned to the key. API keys are suitable for server-side applications, internal tools, and situations where a direct, application-level authorization is sufficient. They are a simpler form of authentication compared to OAuth 2.0, primarily used when the application itself is the principal actor.
• OAuth 2.0: This open standard for access delegation is used for third-party applications to obtain limited access to user accounts on an HTTP service. OAuth 2.0 allows an application to act on behalf of a user without the user ever sharing their credentials with the application. Instead, the user grants permission to the application, and the application receives an access token. WhatJobs implements OAuth 2.0 primarily for integrations where user consent is required, such as connecting a CRM or an applicant tracking system (ATS) that needs to access user-specific data (e.g., job applications, candidate profiles) on WhatJobs. The flow typically involves a user being redirected to WhatJobs to authorize the third-party application, followed by a callback to the application with an authorization code that can be exchanged for an access token. More details on the OAuth 2.0 flow can be found in the OAuth 2.0 specification.

Authentication methods comparison

Getting your credentials

To integrate with the WhatJobs API, you must first obtain the necessary authentication credentials. The process for acquiring these credentials depends on the specific authentication method you intend to use:

• For API Keys:

  1. Create a WhatJobs Developer Account: Navigate to the WhatJobs Developer Portal and sign up for an account if you don't already have one. This account will be linked to your organization or personal developer profile.
  2. Access API Key Management: Once logged in, locate the "API Keys" or "Credentials" section within your developer dashboard. This area typically provides options to generate new API keys, view existing keys, and manage their associated permissions.
  3. Generate a New API Key: Follow the prompts to generate a new API key. During this process, you may be asked to provide a descriptive name for the key (e.g., "My CRM Integration Key") and specify the permissions or scopes it should have. It's recommended to assign only the minimum necessary permissions to each key.
  4. Securely Store Your Key: Upon generation, your API key will be displayed. This is often the only time you will see the full key, so copy it immediately and store it in a secure location. Treat API keys like passwords; do not embed them directly into client-side code, commit them to public version control repositories, or expose them in browser URLs.

• For OAuth 2.0 Client Credentials:

  1. Register Your Application: In the WhatJobs Developer Portal, find the "Applications" or "OAuth Clients" section. You will need to register your application, providing details such as its name, description, and crucial redirect URIs. The redirect URI (or callback URL) is where WhatJobs will send the user back after they authorize your application. Ensure this URL is secure (HTTPS) and correctly configured to handle the authorization response.
  2. Receive Client ID and Client Secret: Upon successful registration, WhatJobs will issue you a Client ID and a Client Secret. The Client ID is a public identifier for your application, while the Client Secret is a confidential key that must be kept secure. The Client Secret is used when exchanging the authorization code for an access token.
  3. Configure Authorized Redirect URIs: Verify that all redirect URIs your application will use are explicitly listed and approved within your application's settings in the developer portal. Mismatched redirect URIs are a common cause of OAuth authentication failures.
  4. Implement the OAuth Flow: Your application will need to implement the standard OAuth 2.0 authorization code flow. This involves directing users to WhatJobs for authorization, handling the callback at your redirect URI, and then exchanging the authorization code for an access token and refresh token using your Client ID and Client Secret.

Always refer to the WhatJobs Developer Portal's getting started guide for the most up-to-date credential acquisition process and specific terminology.

Authenticated request example

Once you have obtained your API key or an OAuth 2.0 access token, you can include it in your API requests to WhatJobs. The most common method is to use the Authorization HTTP header with a Bearer token. Below are examples for both API key and OAuth 2.0 authenticated requests using curl, a common command-line tool for making HTTP requests.

API Key Example

Assuming you have an API key (e.g., YOUR_WHATJOBS_API_KEY) and want to fetch job listings:

curl -X GET \
  https://api.whatjobs.com/v1/jobs \
  -H 'Authorization: Bearer YOUR_WHATJOBS_API_KEY' \
  -H 'Accept: application/json'

In this example:

• -X GET specifies the HTTP GET method.
• https://api.whatjobs.com/v1/jobs is the example API endpoint for retrieving job listings.
• -H 'Authorization: Bearer YOUR_WHATJOBS_API_KEY' sets the Authorization header, including your API key prefixed with Bearer.
• -H 'Accept: application/json' indicates that the client expects a JSON response.

OAuth 2.0 Access Token Example

Assuming you have successfully completed the OAuth 2.0 flow and obtained an access token (e.g., YOUR_WHATJOBS_OAUTH_TOKEN) and want to access user-specific data, such as their job applications:

curl -X GET \
  https://api.whatjobs.com/v1/user/applications \
  -H 'Authorization: Bearer YOUR_WHATJOBS_OAUTH_TOKEN' \
  -H 'Accept: application/json'

This example is similar to the API key example, but uses an OAuth 2.0 access token. The key difference is that the OAuth token represents delegated authorization from a specific user, whereas an API key typically represents the application's own authorization.

For more detailed examples specific to different API endpoints and programming languages, refer to the WhatJobs API documentation's example section.

Security best practices

Implementing strong security practices is crucial when integrating with the WhatJobs platform to protect sensitive data and maintain the integrity of your applications. Adhering to these guidelines helps prevent common vulnerabilities.

Credential Management

• Keep Credentials Confidential: Treat API keys and OAuth client secrets as highly sensitive information. Never hardcode them directly into your application's source code, especially for client-side applications or publicly accessible repositories.
• Use Environment Variables or Secure Configuration Management: Store API keys and secrets in environment variables, secure configuration files, or dedicated secret management services (e.g., AWS Secrets Manager, Google Secret Manager, Azure Key Vault). This separates credentials from code and allows for easier rotation.
• Regular Key Rotation: Periodically rotate your API keys and OAuth client secrets. This minimizes the impact if a key is compromised, as the old key will eventually expire or be revoked.
• Least Privilege Principle: When generating API keys or configuring OAuth scopes, grant only the minimum necessary permissions required for your application's functionality. Avoid using keys with broad administrative access if only read-only access is needed.
• Revoke Compromised Keys Immediately: If you suspect an API key or client secret has been compromised, revoke it immediately through the WhatJobs Developer Portal.

Secure Communication

• Always Use HTTPS: All communications with the WhatJobs API must occur over HTTPS (TLS v1.2 or higher). This encrypts data in transit, protecting against eavesdropping and man-in-the-middle attacks. The API endpoints are designed to enforce HTTPS.
• Validate SSL/TLS Certificates: Ensure your application is configured to properly validate SSL/TLS certificates presented by the WhatJobs API servers. This prevents connections to malicious servers impersonating WhatJobs.

Application Security

• Input Validation and Sanitization: Always validate and sanitize all data received from users or external sources before sending it to the WhatJobs API. This helps prevent injection attacks and ensures data integrity.
• Error Handling: Implement robust error handling for API responses, especially for authentication and authorization errors. Avoid exposing sensitive information in error messages returned to end-users.
• Logging and Monitoring: Log API access and authentication attempts. Monitor these logs for unusual activity, such as a high volume of failed authentication attempts, which could indicate a brute-force attack.
• Protect Redirect URIs (for OAuth): For OAuth 2.0 integrations, ensure your redirect URIs are secured and cannot be exploited to redirect authorization codes or tokens to malicious sites. Use strict matching for redirect URIs and avoid wildcard URLs.
• State Parameter (for OAuth): Implement and validate the state parameter in your OAuth 2.0 flows to mitigate Cross-Site Request Forgery (CSRF) attacks. The state parameter should be a randomly generated value that your application stores and verifies upon receiving the callback.

User Data Protection

• Data Minimization: Only request and store the minimum amount of user data necessary for your application's functionality.
• Regular Security Audits: Conduct regular security audits and penetration testing of your application, especially for those handling sensitive user data and integrating with external APIs like WhatJobs.

By following these best practices, developers can significantly enhance the security posture of their WhatJobs integrations, protecting both their own systems and the data of their users. For more general guidelines on API security, refer to resources from organizations like the Internet Engineering Task Force (IETF) on OAuth 2.0 security best current practices.