Lever · Authentication Profile

Lever Authentication

Authentication

Lever secures its APIs with http and oauth2 across 3 declared security schemes, as derived from its OpenAPI definitions.

Human ResourcesApplicant TrackingRecruitingTalent AcquisitionSoftware-as-a-Service
Methods: http, oauth2 Schemes: 3 OAuth flows: API key in:

Security Schemes

basicAuth http
scheme: basic
bearerAuth http
scheme: bearer
leverOAuth oauth2
· flows:

Source

Authentication Profile

Raw ↑ 
generated: '2026-11-05'
method: searched
source: https://hire.lever.co/developer/documentation#authentication
summary:
  types:
  - http
  - oauth2
  customer_path: API key (basic auth) created by a Super Admin in Settings; endpoint access and confidential-data
    access chosen at key creation
  partner_path: OAuth 2.0 authorization code with refresh tokens; Super Admins authorize an app once for the whole
    organization and can revoke it from settings
  eu: OAuth is supported for customers in the EU. Any integration authorization or action will be re-directed automatically
    to the appropriate data center.
  derived_from: derive-authentication.py over the 19 refined per-resource contracts (basicAuth, bearerAuth), upgraded
    from the documentation on 2026-11-05
schemes:
- name: basicAuth
  type: http
  scheme: basic
  description: API key supplied as the basic auth username with empty password.
  sources:
  - openapi/lever-applications-api-openapi.yml
  - openapi/lever-archive-reasons-api-openapi.yml
  - openapi/lever-audit-events-api-openapi.yml
  - '... (all 19 refined per-resource contracts)'
  docs: https://hire.lever.co/developer/documentation#authentication
  detail: Authenticate to the Lever API via basic auth by providing an API key as the username and leaving the password
    blank. Create and manage your API keys from the Integrations and API page in Settings of your Lever account,
    on the API Credentials tab. Access to confidential data may only be granted during key creation.
- name: bearerAuth
  type: http
  scheme: bearer
  description: OAuth 2.0 bearer access token (Lever Partner OAuth apps).
  sources:
  - openapi/lever-applications-api-openapi.yml
  - openapi/lever-archive-reasons-api-openapi.yml
  - openapi/lever-audit-events-api-openapi.yml
  - '... (all 19 refined per-resource contracts)'
  docs: https://hire.lever.co/developer/documentation#authentication
  detail: The type of token returned is Bearer. This value must be specified along with the access token when making
    authenticated requests. Tokens are issued by the Lever OAuth 2.0 server (see the oauth2 scheme).
- name: leverOAuth
  type: oauth2
  description: OAuth is part of our partner integration program, and apps must be registered. As of 2020, all Lever
    integrations are authenticated using OAuth.
  docs: https://hire.lever.co/developer/oauth
  flows:
    authorizationCode:
      authorizationUrl: https://auth.lever.co/authorize
      tokenUrl: https://auth.lever.co/oauth/token
      refreshUrl: https://auth.lever.co/oauth/token
      scopes:
        applications:read:admin: View all opportunity applications
        archive_reasons:read:admin: View all archived reasons
        audit_events:read:admin: View all audit events
        contact:read:admin: View an opportunity's contact
        contact:write:admin: View and manage an opportunity's contact
        diversity_surveys:read:admin: View all diversity surveys
        eeo_responses:read:admin: View all EEO responses without personally identifiable information
        eeo_responses_pii:read:admin: View all EEO responses with or without personally identifiable information
        feedback:read:admin: View all of an opportunity's feedback
        feedback:write:admin: View and manage all of an opportunity's feedback
        feedback_templates:read:admin: View all feedback templates
        feedback_templates:write:admin: View and manage all feedback templates
        files:read:admin: View all of an opportunity's files
        files:write:admin: View and manage all of an opportunity's files
        form_templates:read:admin: View all form templates
        form_templates:write:admin: View and manage all form templates
        forms:read:admin: View all of an opportunity's forms
        forms:write:admin: View and manage all of an opportunity's forms
        groups:read:admin: View all user groups
        groups:write:admin: View and manage all user groups
        interviews:read:admin: View all of an opportunity's interviews
        interviews:write:admin: View and manage all of an opportunity's interviews
        notes:read:admin: View all of an opportunity's notes
        notes:write:admin: View and manage all of an opportunity's notes
        offers:read:admin: View all of an opportunity's offers
        opportunities:read:admin: required
        opportunities:write:admin: View and manage all opportunities
        panels:read:admin: View all of an opportunity's panels
        panels:write:admin: View and manage all of an opportunity's panels
        permissions:read:admin: View all user or role permissions
        permissions:write:admin: View and manage all user or role permissions
        postings:read:admin: View all postings
        postings:write:admin: View and manage all postings
        referrals:read:admin: View all of an opportunity's referrals
        requisition_fields:read:admin: View all requisition fields
        requisition_fields:write:admin: View and manage all requisition fields
        requisitions:read:admin: View all requisitions
        requisitions:write:admin: View and manage all requisitions
        resumes:read:admin: View all of an opportunity's resumes
        roles:read:admin: View all roles
        roles:write:admin: View and manage all roles
        sources:read:admin: View all sources
        stages:read:admin: View all stages
        tags:read:admin: View all tags
        tasks:read:admin: View all tasks
        uploads:write:admin: Manage all file uploads
        users:read:admin: View all users
        users:write:admin: View and manage all users
        webhooks:read:admin: View all webhooks
        webhooks:write:admin: Manage all webhooks
        offline_access: 'Include offline_access to get a Refresh Token (Lever docs, Step 1: Request User Authorization).'
  required_authorize_params:
  - client_id
  - redirect_uri
  - response_type=code
  - state
  - audience=https://api.lever.co/v1/
  - scope
  refresh_tokens: Include offline_access to get a Refresh Token; access tokens expire and are refreshed without
    the customer re-authenticating.
  sandbox:
    authorizationUrl: https://sandbox-lever.auth0.com/authorize
    audience: https://api.sandbox.lever.co/v1/
  discovery:
    oauth_authorization_server: https://auth.lever.co/.well-known/oauth-authorization-server
    openid_configuration: https://auth.lever.co/.well-known/openid-configuration
    saved:
    - well-known/lever-auth-oauth-authorization-server.json
    - well-known/lever-auth-openid-configuration.json
    note: 'Fetched 2026-11-05 (HTTP 200): issuer https://auth.lever.co/, S256 PKCE, client_secret_basic/post and
      private_key_jwt token auth, revocation at https://auth.lever.co/oauth/revoke. The Lever resource scopes are
      not in scopes_supported (Auth0 tenant lists OIDC scopes only).'
  registration: Partner apps are registered with Lever (integration name, 20-140 character description, callback
    URL(s), square logo, required scopes; maximum 20 scopes). Separate apps exist for sandbox and production.
  sources:
  - https://hire.lever.co/developer/oauth
  - https://hire.lever.co/developer/documentation#authentication
docs: https://hire.lever.co/developer/documentation#authentication
scopes_artifact: scopes/lever-scopes.yml
docs_also: https://hire.lever.co/developer/oauth

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this
  • find_securityBrowse and filter every security artifact in the catalog.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This security artifact 
curl "https://apis.io/api/v1/security/lever-authentication"
All security posture 
curl "https://apis.io/api/v1/security?limit=25"

Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.