Authentication
API keys for your own systems, partner keys for Greenhouse and Ashby.
There are two kinds of credential. Neither is a password, and neither is shown again after it is issued: Capstone keeps only a hash.
| Credential | Format | Sent as |
|---|---|---|
| Company API key | cap_live_<prefix>_<secret> or cap_test_<prefix>_<secret> | Authorization: Bearer <key> |
| ATS partner key | capats_greenhouse_<48 hex> or capats_ashby_<48 hex> | HTTP Basic username, empty password |
Both are prefixed so a leaked key is easy to spot in logs and in secret scanners.
Company API keys
The workspace owner creates keys in the Capstone employer dashboard. Each key has a name, one or more scopes, a live or test label, and an optional expiry date. Only the prefix is shown after creation, so owners can tell keys apart.
curl https://api.usecapstone.com/v1/api/simulations \
-H "Authorization: Bearer cap_live_3f9a1c2e_…"The test label does not create a separate environment. Requests made with a test key touch real data.
Scopes
| Scope | Grants | Status |
|---|---|---|
simulations:read | List the simulations your company can assign | Live |
invites:write | Invite candidates to an assessment | Reserved |
invites:read | Read invitation status | Reserved |
results:read | Read candidate results | Reserved |
Reserved scopes can be granted now, so a key will not need replacing when those endpoints ship.
Revoking
Revoking a key stops it on the next request. Creating and revoking keys are both recorded in an audit log.
ATS partner keys
When a customer connects Greenhouse or Ashby, Capstone issues one partner key for that connection and shows it once. The customer pastes it into the ATS, and the ATS sends it on every call as the Basic username with an empty password:
Authorization: Basic base64("capats_greenhouse_<48 hex>:")A missing key, an unknown key, a revoked connection and a key for the other ATS all return the same 401, so the endpoints cannot be used to find out which companies are connected.
Rotating a partner key stops the old one at once. The customer then pastes the new key into the ATS.