Skip to main content
CBS authenticates every request with a single API key tied to your account. There’s no OAuth flow and no token exchange.

​
One key, used two ways

The widget key and the API key are the same credential:
  • Widget: pass the key in the script src: …/salary.js?key=yourKey. The widget reads it and forwards it to the API.
  • API: send that same value in the pcc-api-key request header.
A widget key is visible in page source by nature of client-side embedding. Keep API keys server-side and never commit them to source control.

​
How this compares to other Symmetry products

CBS uses a plain API key, not a JWT. Symmetry’s products don’t all authenticate the same way, so if you’ve integrated another one, note the difference:

​
Key validation and restrictions

The API validates your key on every request and enforces:
  • Validity: missing, invalid, or disabled keys are rejected with HTTP 401.
  • Product access: the key must be entitled to CBS.
  • Domain restriction (optional): a key can be limited to specific allowed origins; requests from other domains are rejected.
  • Expiration: keys carry an expiration date, surfaced in the X-Pcc-Api-Exp-Date response header.
Usage caps are covered separately in Rate limits.

​
Getting a key

To request a key or get help with an existing one, contact your Symmetry Client Success representative or reach out through the Client Support Center. See Prerequisites for details.