---
title: "Using the API"
description: "Create Reactive Resume API keys, authenticate REST requests with bearer tokens, and integrate resume data into your own scripts, apps, or automations."
---

<Steps>
  <Step title="Sign in to the dashboard">
    Head over to [https://rxresu.me](https://rxresu.me) and sign in with your account credentials.
  </Step>

<Step title="Navigate to API Keys settings">
  In the dashboard sidebar on the left, under <Badge>Settings</Badge>, click the <Badge>API Keys</Badge> link.
</Step>

  <Step title="Open the API reference">
    On the API Keys page, click <Badge>API Documentation</Badge> to open the API reference.

    <Tip>
      You can also open it directly here: [API Reference](https://docs.rxresu.me/api-reference).
    </Tip>

  </Step>

  <Step title="Create a new API key">
    Click <Badge>Create a new API key</Badge>. Fill in:

    - **Name**: A label to help you identify what you use this key for
    - **Expires in**: How long the key should remain valid

  </Step>

  <Step title="Copy the API key (important)">
    The secret key is shown once, right after you create it. Copy it and store it somewhere safe.

    <Warning>
      For security reasons, your API key is only displayed once. If you lose it, you must create a new one.
    </Warning>

  </Step>

  <Step title="Authenticate requests with x-api-key">
    To authenticate API requests, include your key in the <Badge>x-api-key</Badge> header.

    <Info>
      If you're self-hosting, replace <code>https://rxresu.me</code> with your instance URL. The API is served under <code>/api/openapi</code>.
    </Info>

    ```bash
    curl "https://rxresu.me/api/openapi/resumes" \
      -H "x-api-key: YOUR_API_KEY"
    ```

  </Step>

  <Step title="Delete an API key (optional)">
    In the API Keys list, click the trash icon next to a key and confirm deletion.

    <Warning>
      Deleted API keys stop working immediately, and the action cannot be undone.
    </Warning>

  </Step>
</Steps>

## Cover-letter REST endpoint migration

Cover-letter REST operations now use `/cover-letters` resource paths and HTTP methods instead of the automatically generated `/coverLetters/*` POST endpoints. This is a **breaking change for REST clients**: the old REST URLs are no longer served and return `404`. There are no compatibility aliases.

All paths below are relative to `/api/openapi` on your instance. Authentication with `x-api-key` is unchanged.

| Previous endpoint | Replacement endpoint |
| --- | --- |
| `POST /coverLetters/list` | `GET /cover-letters` |
| `POST /coverLetters/getById` | `GET /cover-letters/{id}` |
| `POST /coverLetters/create` | `POST /cover-letters` |
| `POST /coverLetters/update` | `PUT /cover-letters/{id}` |
| `POST /coverLetters/refreshStyle` | `POST /cover-letters/{id}/refresh-style` |
| `POST /coverLetters/duplicate` | `POST /cover-letters/{id}/duplicate` |
| `POST /coverLetters/delete` | `DELETE /cover-letters/{id}` |
| `POST /coverLetters/copyEmbedded` | `POST /cover-letters/from-resume` |
| `POST /coverLetters/export` | `GET /cover-letters/{id}/export` |
| `POST /coverLetters/import` | `POST /cover-letters/import` |

Update request inputs as well as the URL and method:

- Move `id` from the JSON body into the URL path wherever `{id}` appears. URL-encode the ID as a single path segment.
- For listing, send `search`, `resumeId`, `applicationId`, `limit`, and `offset` as query parameters, not a JSON body. The get-by-ID and export operations also have no request body.
- Keep the remaining inputs as JSON for POST, PUT, and DELETE requests, with `Content-Type: application/json`. In particular, `expectedRevision` remains required in the JSON body for update, refresh-style, and delete; refreshing style also requires `resumeId`.
- Create, copy-from-resume, and import keep their existing JSON inputs. Update still modifies only the supplied fields; it does not replace the entire document.
- Successful operations return `200`, including create and delete. Delete has an empty response body; do not expect `204` or parse a JSON document from it. Other response shapes are unchanged.

For example, list cover letters with query parameters:

```bash
curl --get "https://rxresu.me/api/openapi/cover-letters" \
  -H "x-api-key: YOUR_API_KEY" \
  --data-urlencode "search=Engineer" \
  --data-urlencode "limit=20"
```

If you generate an SDK, regenerate it from your instance's `/api/openapi/spec.json` after upgrading: operation IDs have changed too (for example, `coverLetters.getById` is now `getCoverLetter`). Self-hosted clients should use the spec from the version they are running.

This migration applies only to REST under `/api/openapi`. Existing oRPC clients under `/api/rpc` continue to use the same `coverLetters.*` procedure names and RPC protocol; do not apply the REST path or payload changes to them.