Security

Authentication

To access the API you need a JSON Web Token (JWT), issued in exchange for the ClientId and ClientSecret provided to you. Please ensure that you store these credentials securely.

Every other endpoint in this documentation requires the token in the Authorization header, in the format Authorization: Bearer {token}. The token endpoint itself does not require an Authorization header.

HTTP Request [POST]
https://parceiros.empregos.com.br/oauth/v2/accessToken

The body must be sent as application/x-www-form-urlencoded (not JSON).

cURL
C#
JavaScript
Python

curl -X 'POST' \
  'https://parceiros.empregos.com.br/oauth/v2/accessToken' \
  -H 'accept: */*' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -d 'ClientId={{ClientId}}&ClientSecret={{ClientSecret}}'

using System;
using System.Collections.Generic;
using System.Net.Http;
using System.Threading.Tasks;

class Program
{
    private const string AccessTokenUrl = "https://parceiros.empregos.com.br/oauth/v2/accessToken";

    static async Task Main(string[] args)
    {
        await GetAccessToken();
    }

    static async Task GetAccessToken()
    {
        using (HttpClient httpClient = new HttpClient())
        {
            httpClient.DefaultRequestHeaders.Accept.Clear();
            httpClient.DefaultRequestHeaders.Accept.Add(new System.Net.Http.Headers.MediaTypeWithQualityHeaderValue("*/*"));

            var formData = new FormUrlEncodedContent(new[]
            {
                new KeyValuePair<string, string>("ClientId", "{{ClientId}}"),
                new KeyValuePair<string, string>("ClientSecret", "{{ClientSecret}}")
            });

            var response = await httpClient.PostAsync(AccessTokenUrl, formData);

            if (response.IsSuccessStatusCode)
            {
                string accessToken = await response.Content.ReadAsStringAsync();
                Console.WriteLine($"Access Token: {accessToken}");
            }
            else
            {
                Console.WriteLine($"Failed to get access token. Status Code: {response.StatusCode}");
            }
        }
    }
}

const apiUrl = "https://parceiros.empregos.com.br/oauth/v2/accessToken";

const body = new URLSearchParams({
  ClientId: "{{ClientId}}",
  ClientSecret: "{{ClientSecret}}",
});

fetch(apiUrl, {
  method: "POST",
  headers: {
    Accept: "*/*",
    "Content-Type": "application/x-www-form-urlencoded",
  },
  body, // URLSearchParams is sent form-encoded
});

import requests

url = 'https://parceiros.empregos.com.br/oauth/v2/accessToken'

headers = {
    'accept': '*/*',
    'Content-Type': 'application/x-www-form-urlencoded'
}

data = {
    'ClientId': '{{ClientId}}',
    'ClientSecret': '{{ClientSecret}}'
}

# a dict passed to `data` is sent form-encoded
response = requests.post(url, headers=headers, data=data)

Parameters [Request]

Field	Description	Type	Required
ClientId	Client identifier provided to the partner.	String	Yes
ClientSecret	Client secret provided to the partner. It is a GUID, e.g. `3fa85f64-5717-4562-b3fc-2c963f66afa6`.	GUID	Yes

Responses

200 OK: credentials accepted. The response is a JSON object with the issued token in the token property. Send it on every other request as Authorization: Bearer {token}.
400 Bad Request: invalid credentials or an unexpected error.
```
{
  "success": false,
  "message": ["Invalidated credentials"]
}
```
If ClientSecret is not a valid GUID, the request is rejected before reaching the credential check, with a standard 400 validation response.

Transport

All endpoints must furnish a verifiable SSL certificate signed by a well-known Certificate Authority (such as those trusted by Mozilla). If your web browser can visit the endpoint without generating a security warning, we can support it.