Overview
Steps
1. Register your app
2. Generate the Authorization Basic header value
3. Get an access token
ID tokens
See also
RFCs
Guides
References

Token exchange grant type (OAuth)

Exchange a security token for an Indeed access token.

legal notice

By using this API and its documentation and building an integration, you agree to the Additional API Terms and Guidelines.

Overview

Use the token exchange grant type to exchange an ID token from your identity provider for an Indeed access token. This grant type follows RFC 8693: OAuth 2.0 Token Exchange.

Steps

To start this integration or ask questions, contact indeed-ciam-integrations-support@indeed.com.

1. Register your app

Japan only

Sign in to the Manage app credentials (opens in a new window) page with your Indeed account, and select Register new application.
On the Provide basic information page, enter your app name and description. For Credential type, select OAuth 2.0, then select Save and continue.
On the Select OAuth grant types page, select Client credentials, then select Save and continue.
On the Provide additional information page, add any other details, then select Save and continue.
On the Preview app page, review your app information, then select Complete registration.

Note your client ID and secret on the Credentials page. Don't share your secret.
Send your client ID to Indeed, so that Indeed can add your app to the token exchange allowlist.

Outside of Japan

To build an Indeed Apply XML integration, contact the Indeed Client Success team (opens in a new window). After you sign the Developer Agreement, Indeed sets up an app for your integration.

To view your app and its Indeed Apply API token credentials, sign in to Partner Console (opens in a new window):

The API token credentials are a client ID and secret.
Include the API token with each job that you post to Indeed.

2. Generate the Authorization Basic header value

See also Basic Authentication Scheme (opens in a new window) in RFC 2617: HTTP Authentication: Basic and Digest Access Authentication.

To generate the Authorization Basic header value:

Concatenate the client_id and client_secret with a colon (:) as a separator.
```
base64.encode("<client_id>:<client_secret>");
```

Apply the Base64-encoding algorithm to the string:

base64.encode("5e175cbb7f88e2048bd95323bbc9ca2fcec32ad60f95f7ee66ab53e099abe6f3:pJ4qRe2sdXRP0Whr3bwz9D37exFuuOtqJDRHMmmlLWV7J25rH7oItrPNCKzhaQf2");

Pass the Base64-encoded string as a basic HTTP Authorization header:

Authorization: Basic NWUxNzVjYmI3Zjg4ZTIwNDhiZDk1MzIzYmJjOWNhMmZjZWMzMmFkNjBmOTVmN2VlNjZhYjUzZTA5OWFiZTZmMzpwSjRxUmUyc2RYUlAwV2hyM2J3ejlEMzdleEZ1dU90cUpEUkhNbW1sTFdWN0oyNXJIN29JdHJQTkNLemhhUWYy

3. Get an access token

Send a POST request to https://apis.indeed.com/oauth/v2/tokens with the Authorization: Basic header from step 2 and your ID token:

curl -L 'https://apis.indeed.com/oauth/v2/tokens' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -H 'Authorization: Basic <credentials>' \
  -d 'grant_type=urn:ietf:params:oauth:grant-type:token-exchange' \
  -d 'subject_token_type=urn:ietf:params:oauth:token-type:id_token' \
  -d 'scope=email offline_access' \
  -d 'subject_token=xxxxx.yyyyy.zzzzz'

The request headers are:

Get an access token
Header	Value
`Authorization`	`Basic <credentials>` Replace `<credentials>` with the Base64-encoded value from step 2.
`Content-Type`	`application/x-www-form-urlencoded`

The request body parameters for oauth/v2/tokens are:

oauth/v2/tokens request body parameters
Request body parameter	Required	Value
`grant_type`	✔	`urn:ietf:params:oauth:grant-type:token-exchange` Type: string
`scope`	Optional	The scopes to grant in the Indeed access token. See Scopes. Example: `openid`
`subject_token`	✔	A token that identifies the user you're acting on behalf of. The token issuer must give Indeed a way to validate it. Indeed supports only ID tokens. Example: `xxxxx.yyyyy.zzzzz`
`subject_token_type`	✔	The type of token in the `subject_token` field. Example: `urn:ietf:params:oauth:token-type:id_token`

A successful response looks like this:

HTTP/1.1 200 OK
Content-Type: application/json

{
  "access_token": "<access_token>",
  "scope": "email offline_access",
  "issued_token_type": "urn:ietf:params:oauth:token-type:access_token",
  "token_type": "Bearer",
  "expires_in": 3600
}

A failed response looks like this:

HTTP/1.1 400 Bad Request
Content-Type: application/json

{
  "error": "invalid_request"
}

The response fields are:

Response fields
Response field	Type	Description
`access_token`	String	Your access token. Example: `eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6Ikpv[...]`
`error`	String	The error type. Example: `"error": "invalid_request"`
`error_description`	String	A description of the error. Example: `"error_description": "Invalid Request."`
`expires_in`	Integer	How long the access token is valid, in seconds. Access tokens are valid for one hour (3600 seconds). Example: `3600`
`issued_token_type`	String	The type of the issued token. Example: `urn:ietf:params:oauth:token-type:access_token`
`scope`	String	The scopes granted to your app, separated by spaces. Example: `email offline_access`
`token_type`	String	Always `Bearer`. Example: `Bearer`

ID tokens

The ID token is a JSON Web Token (JWT) (opens in a new window).

The following table distinguishes required from optional claims. See OpenID Connect Core 1.0 ID Token (opens in a new window) for the OpenID Connect requirements.

Besides the claims that OpenID requires, Indeed reads these fields in the JWT body when they're present:

ID tokens
Field	Required	Description
`aud` Type: `string`		The intended recipient of the ID token: the client ID of the external app that received it. Example: `6ae943d9e10b6576f51185ca5ce3353f`
`auth_ip` Type: `string`		The user's IPv4 address when they signed in. See RFC 1918. Example: `160.67.221.147`
`auth_time` Type: JSON number		When the user last authenticated. Example: `1741209846`
`exp` Type: JSON number		The expiration time. Indeed rejects the token after this time. The issued access token expires at the same time. Example: `1741209848`
`iat` Type: JSON number	✔ for all integrations	When the JWT was issued. Example: `1741209847`
`iss` Type: `string`		The URI of the system that issued the JWT. Example: `https://partner.com/`
`sub` Type: `string`	✔ for all integrations	The user's ID in the identity provider. It must map to `externalId` in SCIM. Example: `CU1234`
`name` Type: `string`		The user's full name, formatted for display in their locale. Example: `Job Seeker`
`email` Type: `string`	✔ for all integrations	The user's preferred email address, in the addr-spec format (opens in a new window) of RFC 5322. Example: `jobseeker123@indeed.com`
`email_verified` Type: `boolean`		Whether you verified the user's email address. If you omit it, Indeed assumes that the address isn't verified. Example: `true` or `false`
`family_name` Type: `string`	✔ for some integrations	The user's last name. Separate multiple last names with a space. Example: `Seeker`
`given_name` Type: `string`		The user's first name. Separate multiple first names with a space. Example: `Job`
`locale` Type: `string`		The user's locale, as a BCP 47 (RFC 5646) language tag. Usually a lowercase ISO 639 (opens in a new window) language code and an uppercase ISO 3166-1 (opens in a new window) country code, separated by a hyphen. Example: `en-US`
`phone_number` Type: `string`		The user's phone number, in E.164 (opens in a new window) format. Example: `+14255551212`
`phone_number_verified` Type: `boolean`		Whether the phone number is verified. If you include `phone_number` but omit this field, Indeed assumes that the number isn't verified. Example: `true` or `false`
`updated_at` Type: JSON number		When the user's information was last updated. Example: `1741201234`

On this page

Token exchange grant type (OAuth)

Overview

Steps

1. Register your app

Japan only

Outside of Japan

2. Generate the Authorization Basic header value

3. Get an access token

ID tokens

See also

RFCs

Guides

References

Was this page helpful?

On this page

Was this page helpful?