API access for automated workflows

For everyday interactive use — SeekOut MCP inside Claude, ChatGPT, Cursor, or another AI assistant — the standard OAuth sign-in is simpler and recommended, and you don’t need automated workflow credentials. But some environments make browser-based sign-in impractical. In those cases, SeekOut provisions an automated workflow credential (also called a machine-to-machine, or M2M, credential) bound to a specific SeekOut user, so an automated workflow can act as that user across the MCP operations it’s provisioned for — search, contacts, exports, workspaces, and the indexes they’re entitled to — without a browser sign-in. The bound account can be a specific recruiter or a dedicated service-account user set up for automation; either way, the credential inherits that account’s permissions, credits, and index access.

If you’re used to other vendors’ API keys: SeekOut uses OAuth 2.0 client credentials instead of a static API key. You receive a client ID and client secret and exchange them for a short-lived bearer token. This is more secure — the secret is rotatable, tokens expire automatically, and access is scoped to the MCP server.

When to use automated workflow credentials

Automated workflow credentials are intended for non-interactive and automated use cases. Consider them when:

You’re running a CI/CD pipeline or scheduled job that calls SeekOut MCP with no human present to complete an OAuth sign-in.
You’re building a server-side integration where a backend service — not an individual user — makes MCP requests.
You’re deploying in a headless or non-interactive environment where opening a browser for authentication isn’t feasible.

Because the credential is bound to a SeekOut user, the workflow can perform the supported MCP operations that user is permitted to — search, retrieve contacts, run exports, use their workspaces, and search the indexes they’re entitled to (GitHub, expert, and so on).

How to get automated workflow credentials

Automated workflow credentials are provisioned by SeekOut on request — they are not self-service. A SeekOut administrator creates the credential bound to the SeekOut user it should act as, configured with the permissions and rate limits your use case needs.

Identify the user and your requirements

Decide which SeekOut user the credential should act as — its access, indexes, and credits all come from that user. Also be ready to describe which tools the workflow needs and the expected request volume, so the team can set the right permissions and rate limits.

Contact SeekOut Support or your account team

Open a support ticket or reach out to your SeekOut account representative and request automated workflow credentials for SeekOut MCP, specifying the user the credential should be bound to.

Receive and store your credentials securely

SeekOut delivers a client ID and a client secret (shown once) through a secure channel. Store them in a secrets manager, environment variable, or vault — never in plain text or source control.

The credential is bound to that user for its lifetime, and acts with that user’s permissions and credits. To act as a different user, request a new credential (and revoke the old one).

How to authenticate

Automated workflow credentials use the OAuth 2.0 client_credentials grant: exchange your client ID and secret for a short-lived bearer token, then send that token on each request to the MCP server. 1. Exchange your credentials for an access token

curl -X POST https://app.seekout.io/api/oauth/token \
  -d "grant_type=client_credentials" \
  -d "client_id=YOUR_CLIENT_ID" \
  -d "client_secret=YOUR_CLIENT_SECRET" \
  -d "scope=mcp:tools" \
  -d "resource=https://seekout-search-mcp.seekout.io/tools"

The response contains a short-lived bearer token:

{
  "access_token": "<short-lived JWT>",
  "token_type": "Bearer",
  "expires_in": 3600,
  "scope": "mcp:tools"
}

2. Call the MCP server with the token

Authorization: Bearer <access_token>

For MCP clients that read a JSON config file, add the token as a custom header:

{
  "mcpServers": {
    "seekout-search": {
      "url": "https://seekout-search-mcp.seekout.io/tools",
      "headers": {
        "Authorization": "Bearer <access_token>"
      }
    }
  }
}

3. Get a fresh access token when it expires Access tokens are short-lived (see expires_in) and there is no refresh token — to renew, simply re-run the step 1 exchange. Your service already holds the client secret, so it can mint a new access token at any time with no extra state to track. A common pattern is to request a token on startup and request another whenever a request returns 401 Unauthorized.

Don’t hardcode a token in a static config file — tokens expire. Fetch one at runtime instead. The client secret itself doesn’t expire (though SeekOut can rotate it), which is why re-exchanging it is the recommended path.

Security best practices

Store secrets in a secrets manager. Use a dedicated secrets manager (AWS Secrets Manager, HashiCorp Vault, or your CI platform’s secret store) rather than committed env files. Inject the secret at runtime.
Bind to the right user. The credential acts with its bound user’s permissions and credits, so bind it to a user whose access matches what the workflow should be able to do — no more.
Provision least privilege. On top of choosing the right bound user, ask SeekOut to configure the minimum tools and permissions your workflow needs. A credential used only for search doesn’t need workspace or export access.
Rotate credentials after exposure. If a secret may be exposed — for example, accidentally committed — contact SeekOut Support immediately to rotate it. Don’t wait to confirm the exposure.
Audit credential usage. Ask your SeekOut administrator to periodically review credential usage in the admin console. Unused or unexpectedly high-volume credentials should be investigated and rotated.

	OAuth sign-in (recommended for interactive use)	Automated workflow credentials (for non-interactive use)
Best for	Individual users, AI desktop assistants	CI pipelines, server integrations, headless environments
Authentication flow	Browser-based sign-in via your SeekOut account	`client_credentials` grant → bearer token in request headers
Credentials	Managed by your SeekOut login session	Client ID + client secret, provisioned by SeekOut
Acts as	The signed-in user	The SeekOut user the credential is bound to
Rate limits	Per-user limits applied to your account	Configured per-credential by SeekOut at provisioning
Setup	Sign in once	Provisioned by SeekOut; exchange credentials for a token

For user, administrator, and automated-workflow revocation, see Revoking access.

When in doubt, start with OAuth sign-in. It’s simpler to set up and needs no provisioning step. Switch to automated workflow credentials only when your environment genuinely can’t support an interactive sign-in flow.

Already have an older automated workflow credential?

Some older credentials (provisioned back when they were called M2M credentials) were not bound to a user and are limited to search only — they can’t retrieve contacts, run exports, use workspaces, or search non-public indexes. Calls that need a user identity return errors such as Recruiter was not found or credit balances aren't available for M2M service credentials. If you have one of these and need fuller access, contact SeekOut to reissue it as a user-bound automated workflow credential (above).

Getting started

Connect your assistant

Use SeekOut MCP

Security and access

Reference and help

When to use automated workflow credentials

How to get automated workflow credentials

How to authenticate

Security best practices

Already have an older automated workflow credential?

​When to use automated workflow credentials

​How to get automated workflow credentials

​How to authenticate

​Security best practices

​OAuth sign-in vs. automated workflows

​Already have an older automated workflow credential?

When to use automated workflow credentials

How to get automated workflow credentials

How to authenticate

Security best practices

OAuth sign-in vs. automated workflows

Already have an older automated workflow credential?