What security features and authentication mechanisms are supported for RChilli API access?

RChilli secures API access through private API credentials, HTTPS with SSL/TLS encryption, account validation, and established security standards.

Step 1: Use Private API Key Authentication

RChilli APIs use a private key to authenticate API requests.

The credential name can vary depending on the API:

userkey – used by APIs such as Resume Parser, JD Parser, Plugin etc.
indexKey – used by Search & Match.
apiKey - used by Taxonomy
Other API-specific credential names may apply according to the relevant API documentation.

The private User Key can be obtained from the RChilli My Account portal. Search & Match uses the User Key as the Index Key for authentication.

Step 2: Use HTTPS with SSL/TLS

RChilli API endpoints use HTTPS with SSL/TLS to secure data during transmission.

SSL/TLS:

Encrypts communication between the client application and RChilli.
Protects transmitted data from interception.
Secures the communication channel.

The private API key provides API-level authentication, while SSL/TLS protects the communication channel.

Step 3: Verify Account and Subscription Status

API access also depends on valid account and subscription details.

For applicable services, verify:

API key validity.
Active subscription.
Available parsing credits.
Parsing expiration date.

When applicable credits are exhausted or the parsing period expires, the API key may stop working until the applicable plan or access is renewed.

Step 4: Review Mutual SSL Requirements

Standard RChilli API access uses HTTPS/SSL-TLS together with private API key authentication.

For requirements involving Mutual SSL (mTLS) or client-certificate authentication, contact RChilli Support for availability and custom setup details.

Step 5: Review Security Certifications

RChilli lists the following security certifications:

ISO/IEC 27001:2022
SOC 2 Type II

These certifications support established information-security and data-protection practices.

Recommended Security Practices

Follow these practices when integrating with RChilli APIs:

Store API credentials securely.
Do not expose API keys in client-side applications.
Do not commit credentials to public source-code repositories.
Do not include complete API credentials in application logs.
Use only HTTPS API endpoints.
Mask sensitive credentials before sharing logs or API requests for troubleshooting.
Contact RChilli Support for specialized security requirements such as mTLS, certificate-based authentication, IP restrictions, key-rotation policies, SIEM integration, or specialized audit logging.

Note

SSL/TLS secures API communication, while the private API key authenticates API requests. Requirements beyond the standard authentication model should be reviewed with RChilli Support before implementation.

For more information, contact RChilli Support.