Reference
Access and API keys
Choose access for your integration, manage credentials and handle request limits.
Anonymous REST access supports discovery and small experiments. For a recurring integration, create an API key in Settings → API keys, accessed by clicking your name in the app.
curl --fail 'https://withpanta.com/api/v1/jobs?limit=5' \
-H "Authorization: Bearer $PANTA_API_KEY"Keys are read-only credentials for public market data. They cannot read CVs, conversations or personal workspaces, or submit applications. Keep keys in your server's secret store, never in browser code, URLs, shared prompts or source control.
You can have five active keys. The complete value is shown only when created. Choose an expiration of 7, 30, 90 or 365 days when creating a key (90 days by default); create a replacement and revoke the old key when rotating. Revocation takes effect on subsequent requests. An invalid, expired or revoked key returns 401 rather than falling back to anonymous access.
| Access | Rate limit |
|---|---|
| Anonymous | 30 requests per minute per IP address, per Cloudflare location. |
| API key | 120 requests per minute per key, per Cloudflare location. Keyed requests also share an IP gate of 120 per minute. |
These limits apply to REST. MCP requires OAuth and allows 120 requests per minute per user/client plus a shared IP gate. They are approximate abuse controls, not a global quota or throughput guarantee. Check X-RateLimit-Limit; 429 responses include Retry-After: 60. Back off with jitter. Public REST supports cross-origin reads without cookies. MCP browser connections must be same-origin; native MCP clients can connect without an Origin header.