Client credentials grant type (2-legged OAuth)

Authorize your app to act on behalf of itself.

 

legal notice

By using this API and its documentation and building an integration, you agree to the Additional API Terms and Guidelines.

Overview

Use the client credentials grant type when your app calls Indeed APIs on its own behalf, without a user signing in. Your app exchanges its client ID and secret for an access token, then sends the token with each API call.

You can also:

• Get an employer access token.
• Authorize an app to act on your behalf.
• Enable another company to act on your behalf.

---

Steps

1. Get your OAuth credentials

When you become an Indeed partner, Indeed creates an app for your integration. Sign in to Partner Console (opens in a new window) to view the app and your OAuth credentials: client ID and secret. Exchange those credentials for an access token to authenticate API calls.

---

2. Get an access token

To get an access token, send a POST request to https://apis.indeed.com/oauth/v2/tokens with these headers and body parameters, using a command-line tool like curl (opens in a new window) or a UI tool like Insomnia (opens in a new window).

Don't expose the client secret to end users. Indeed recommends generating tokens in the backend.

curl -L 'https://apis.indeed.com/oauth/v2/tokens' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -d 'client_id=<client_id>' \
  -d 'client_secret=<client_secret>' \
  -d 'grant_type=client_credentials' \
  -d 'scope=employer_access'

The request headers are:

Get an access token request headers

Header	Value
Accept	application/json
Content-Type	application/x-www-form-urlencoded

The request body parameters are:

Get an access token request body parameters

Request body parameter	Value	Description
client_id	<client_id>	Replace with your client ID.
client_secret	<client_secret>	Replace with your client secret.
grant_type	client_credentials	Requests the client credentials grant (2-legged OAuth).
scope	employer_access	Lists employer accounts associated with the user that registered the app, or gets an access token for an associated employer account.

{
  "access_token": "<access_token>",
  "scope": "employer_access",
  "token_type": "Bearer",
  "expires_in": 3600
}

Your token expires in one hour (3600 seconds). Refresh your token hourly.

---

3. Call Indeed APIs

To call an Indeed GraphQL API, send a POST request to https://apis.indeed.com/graphql with these headers and your GraphQL query or mutation:

curl -L 'https://apis.indeed.com/graphql' \
  -H 'Authorization: Bearer <access_token>' \
  -H 'Content-Type: application/json' \
  -d '{"query":"query {\n  jobSearch(\n    location: { radius: 5, radiusUnit: MILES, where: \"Austin\" }\n    what: \"Nurse\"\n    limit: 5\n  ) {\n    results {\n      job {\n        title\n        sourceEmployerName\n      }\n    }\n  }\n}","variables":{}}'

Request headers:

HTTP request headers

Header	Value	Description
Authorization	Bearer <token>	Use this header to authenticate with the server and access protected resources. Pass the access token in this header with the Bearer authentication scheme. For the oauth/v2/tokens endpoint, use the basic authentication scheme instead of passing client_id and client_secret in the request body. See Get an access token, Authorization header (opens in a new window), and Basic authentication scheme.
Content-Type	application/json	The media type (opens in a new window) of the resource. See Content-Type header (opens in a new window).

The -d parameter specifies the GraphQL query:

query {
  jobSearch(location: {
      radius: 5,
      radiusUnit: MILES,
      where: "Austin"
    }
    what: "Nurse"
    limit: 5) {
    results {
      job {
        title
        sourceEmployerName
      }
    }
  }
}

{
  "errors": [{
    "message": "The client does not have access to the 'job-retrieval-service' service.",
    "extensions": {
      "code": "INTERNAL_SERVER_ERROR"
    }
  }],
  "data": null
}

---

Additional tasks

Get an employer access token

Some Indeed APIs require an access token that represents an employer or advertiser. In the following procedure, use advertiser instead of employer where needed.

To get an access token for an employer:

1. Build a selection screen that lists the employers the user can manage.
2. After the user selects an employer, get an access token that represents that employer.

Each access token represents one employer. To switch employers, get a new access token.

Build selection screen

1. Get an access token with scope=employer_access.

   This scope lets you list the employer accounts associated with the account that registered the app.

2. Call the https://secure.indeed.com/v2/api/appinfo endpoint with your access token in the Authorization header:

   curl -L 'https://secure.indeed.com/v2/api/appinfo' \
     -H 'Authorization: Bearer <access_token>'

   The request header is:

   Request header

   Header	Value
   Authorization	Bearer <access_token> Replace <access_token> with your access token.

   The response lists the id and name of each employer account that the user can manage:

   {
     "employers": [
       {
         "id": "084a39249af95beedfb90cc5d2b8833c",
         "name": "Dharma Initiative"
       },
       {
         "id": "865e08b649774436ee1f410b611fad7c",
         "name": "Umbrella Corporation"
       },
       {
         "id": "4bc393648e880bc94dd6cef8efbc8486",
         "name": "US Robotics and Mechanical Men"
       }
     ]
   }

   In this example, the id for US Robotics and Mechanical Men is 4bc393648e880bc94dd6cef8efbc8486.

3. Display the employer list, and let the user select one.

Get employer access token

After the user selects an employer, send a POST request to https://apis.indeed.com/oauth/v2/tokens with the selected employer's ID:

curl -L 'https://apis.indeed.com/oauth/v2/tokens' \
 -H 'Accept: application/json' \
 -H 'Content-Type: application/x-www-form-urlencoded' \
 -d 'grant_type=client_credentials' \
 -d 'scope=employer_access' \
 -d 'client_id=<client_id>' \
 -d 'client_secret=<client_secret>' \
 -d 'employer=<employer_id>'

The request headers are:

Get an employer access token request headers

Header	Value
Accept	application/json
Content-Type	application/x-www-form-urlencoded

The request body parameters are:

Get an employer access token request body parameters

Request body parameter	Required	Value
grant_type	✔	client_credentials
scope	✔	employer_access
client_id	✔	Your client ID.
client_secret	✔	Your client secret.
employer	✔	The ID of the employer that the user selected.

The response contains an access token that represents the selected employer:

{
  "access_token": "<access_token>",
  "scope": "employer_access",
  "token_type": "Bearer",
  "expires_in": 3600
}

If the user doesn't manage the selected employer, you get this error:

{
  "error_description": "Invalid request",
  "error": "invalid_request"
}

---

Authorize an app to act on your behalf

Use the Indeed Users page to authorize an app to act on your behalf, or to remove its authorization.

1. On the Indeed Users (opens in a new window) page, select an employer account, then select Add users.
2. Enter the user's email address, and select an access level.
3. Select Save and notify new users.

The user gets an email invitation to join your organization on Indeed. When they accept, they get the access level that you selected.

---

Enable another company to act on your behalf

Share your employer ID with the company.

Your employer ID appears in small text above the footer of the Indeed Users (opens in a new window) page. It isn't secret, so you can share it with other companies.

---

See also

Guides

• Credentials — Explains the OAuth client ID and secret that let your app use Indeed services.
• Basic authentication scheme — Explains how to send your client ID and secret in a header instead of the /oauth/v2/tokens request body.
• Troubleshoot OAuth errors — Explains how to fix OAuth errors that occur before you reach GraphQL.
• Troubleshoot GraphQL errors — Explains how to diagnose errors that GraphQL APIs return.

References

• HTTP request headers — Lists the HTTP request headers for OAuth requests.
• oauth/v2/tokens endpoint — Explains how to exchange your client ID and secret for an access token.
• v2/api/appinfo endpoint — Explains how to list the employers associated with the user account that registered the app.

 

Was this page helpful?