Developer guide

Authorize browser access

1. Open Settings in the desktop app.
2. Under Browser access, generate a code.
3. Open API & developer guide and enter the code within two minutes.

Each code works once. Browser access lasts up to eight hours and ends when you log out, revoke browser access, quit CandidTalentEdge, or reach the session limit. Codes and browser sessions do not survive an app restart. Ordinary new tabs need a new code. Duplicating an authorized tab can copy its session, and those tabs share logout, revocation, and expiry.

Connect a local integration

Create an integration token

1. In Settings, open Integrations, select New integration, and enter a name.
2. Choose Read only or Read and process candidates.
3. Select Create token and save the token when it appears. CandidTalentEdge cannot show it again.

Read only can access supported jobs, candidates, and documents. Read and process candidates can also start paid AI processing without asking again in CandidTalentEdge. CandidTalentEdge does not enforce a spending cap for an integration. Integration tokens survive app restarts and remain valid until revoked.

Make your first request

Copy the numeric loopback address shown in Settings. CandidTalentEdge prefers port 8787 but may choose another port. If a connector cannot reach CandidTalentEdge, copy the current address again. Do not guess or scan for it. Reject redirects and never send a credential while discovering an address.

Use integrations only on a trusted personal computer. A bearer token authorizes the request, but it does not prove the identity of the local server.

Replace the placeholders below with the address and token you copied:

CTE_API_ADDRESS=http://127.0.0.1:8787
CTE_INTEGRATION_TOKEN=<your-integration-token>
curl --fail --max-redirs 0 \
  --header "Authorization: Bearer ${CTE_INTEGRATION_TOKEN}" \
  "${CTE_API_ADDRESS}/jobs"

This read-only request lists jobs.

Replace or revoke a token

If a token is lost, create a replacement, update and test the connector, then revoke the old token. Revocation blocks its next authorization check. Work already accepted may finish.

Session and development reference

Browser credential storage

The browser stores its short-lived credential in sessionStorage. CandidTalentEdge does not put codes or credentials in URLs, cookies, localStorage, generated examples, or static files.

Source development

For source development, run the source desktop app against a current built UI. The standalone API accepts an existing integration token but cannot create an owner browser session without the trusted desktop process. Separate Vite origins are not authorized.

Local listener limitation

A malicious local process could bind CandidTalentEdge's old port while CandidTalentEdge is stopped and imitate the listener to collect a credential. Loopback checks, CORS, health responses, and version responses do not prove server identity.