> ## Documentation Index
> Fetch the complete documentation index at: https://docs.exterview.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# API Authentication

> API key and OAuth authentication model for the Exterview API, including the scopes required before the intelligence surface publishes for external integrations.

<Warning>
  **Not implemented yet.** Today the platform uses a first-party human-login
  session, which is not a partner integration model. This page documents the
  requirement, not a shipped feature.
</Warning>

## Purpose

The authentication and scope model the API must have before the intelligence surface publishes for external integrations.

## What is required before this publishes

1. **API-key or OAuth client-credentials** auth, replacing first-party login JWTs.
2. **Scopes**, at minimum:
   * `read`
   * `write`
   * `destructive`
   * `billing/comms-impacting`, for operations that spend money or message candidates (phone calls, AI interviews, invite sends)
3. **Per-key rate limits and quotas** across every published endpoint, at parity with the protections already enforced on Exterview's other production services (request throttling, quota headers, idempotency keys).
4. **Per-organization data-access controls** enforced at the API gateway for every published operation.
5. **GraphQL versioning and a deprecation policy.**
6. **DPA and legal sign-off** for any operation returning candidate PII (reports, transcripts, recordings).

## Scope-gated operations

Some operations are scoped even once auth exists:

| Scope                      | Operations                                                                                                           |
| -------------------------- | -------------------------------------------------------------------------------------------------------------------- |
| `billing/comms-impacting`  | `initiatePhoneCall`, `initiateBulkPhoneCalls`, `startAiInterview`, `sendAiInterviewInvites`, `sendPanelRoundInvites` |
| `decisions:write`          | `overrideRoundDecision`, `overrideCandidateDecision`, `saveScoringConfig`                                            |
| `write`                    | Create and update mutations across Jobs, Candidates, and Resume scoring                                              |
| `destructive` (or omitted) | `deleteJob`, `bulkDeleteJobs`, `deleteCandidate`, `bulkDeleteCandidates`                                             |

<Note>
  The [Career Page](/capabilities/career-page) capability is exempt. It is
  public and unauthenticated by design.
</Note>

## Tracking

Progress against this checklist is tracked internally. Nothing in the [Capabilities](/capabilities/instant-interviews) section of this site goes live until every box is checked.

## FAQs

<AccordionGroup>
  <Accordion title="Can we integrate with the API today?">
    Not as a partner. The only credential today is a first-party login token. API-key or OAuth client-credentials auth is required first.
  </Accordion>

  <Accordion title="What scopes will exist?">
    At minimum `read`, `write`, `destructive`, and `billing/comms-impacting`, plus
    `decisions:write` for decision overrides.
  </Accordion>

  <Accordion title="Why are some operations scope-gated?">
    Because they spend money, message candidates, or change the hiring audit
    trail. Those are never in the default read tier.
  </Accordion>

  <Accordion title="Is anything public without auth?">
    Yes, the Career Page. Every other capability sits behind this checklist.
  </Accordion>
</AccordionGroup>

## Related

<CardGroup cols={2}>
  <Card title="Developer Preview" icon="diagram-project" href="/api-reference/introduction">
    How the API is shaped, scoped, and planned to work.
  </Card>
</CardGroup>