Elsin for scripts and agents.

Authorization: Bearer elsin_live_…
# or, for tools that cannot set Authorization:
X-Api-Key: elsin_live_…

https://elsin.io/.well-known/oauth-protected-resource
https://elsin.io/.well-known/oauth-authorization-server

claude mcp add --transport http elsin https://elsin.io/api/mcp
# then run /mcp in Claude Code and sign in to Elsin
# add --scope user to use it in every project

claude mcp add --transport http elsin https://elsin.io/api/mcp \
  --header "Authorization: Bearer $ELSIN_API_KEY"

{
  "mcpServers": {
    "elsin": {
      "serverUrl": "https://elsin.io/api/mcp"
    }
  }
}

{
  "model": "<a Grok model>",
  "input": "Which open jobs have flagged candidates waiting for review?",
  "tools": [
    {
      "type": "mcp",
      "server_url": "https://elsin.io/api/mcp",
      "server_label": "elsin",
      "authorization": "Bearer <your Elsin API key>"
    }
  ]
}

curl "https://elsin.io/api/v1/jobs?status=open&limit=20" \
  -H "Authorization: Bearer $ELSIN_API_KEY"

{
  "data": [
    { "id": "6f1c…", "title": "Staff Engineer", "status": "open", … }
  ],
  "next_cursor": "eyJ2Ijoi…"
}

curl -X POST "https://elsin.io/api/v1/review/$CANDIDATE_ID/decisions" \
  -H "Authorization: Bearer $ELSIN_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: 5d0e1a52-…" \
  -d '{ "action": "request_verification", "note": "Asked for an ID check" }'

HTTP/1.1 202 Accepted
{
  "data": {
    "outcome": "proposed",
    "proposal": { "id": "…", "action": "request_verification", "status": "pending", … },
    "level": null,
    "verification_link": null
  }
}

HTTP/1.1 403 Forbidden
{
  "error": {
    "code": "insufficient_scope",
    "message": "…",
    "request_id": "3b9f2c1e-…"
  }
}

POST /your/endpoint
Content-Type: application/json
Elsin-Signature: t=1793000000,v1=5257a869e7ecebeda32affa62cdca3fa51cad7e77a0e56ff536d0ce8e108d8bd
Elsin-Event-Id: 0b6c6f0e-6b8e-4c3e-9a8e-2b6f2d1c9e11
Elsin-Event-Type: application.hired
Elsin-Delivery-Id: 7f1d9a52-3a43-4f4f-8c55-0d2e5b0b4a10

{
  "id": "0b6c6f0e-6b8e-4c3e-9a8e-2b6f2d1c9e11",
  "type": "application.hired",
  "created_at": "2026-10-23T18:04:11.000Z",
  "organization_id": "11ea5e16-0061-56c6-b06b-ed7de3b9011a",
  "data": {
    "actor_id": "a5b84e1d-8b29-5118-a3c8-e21e56a59ceb",
    "subject": {
      "candidate_id": "…", "application_id": "…", "job_id": "…",
      "interview_id": null, "offer_id": null
    },
    "candidate": {
      "id": "…", "name": "Ada Okafor", "email": "ada@example.com",
      "verification_level": "verified"
    },
    "job": { "id": "…", "title": "Staff Engineer" },
    "facts": { "stage": "Hired", "stageKind": "hired" }
  }
}

import { createHmac, timingSafeEqual } from 'node:crypto';

function verify(secret, header, rawBody) {
  let t = null;
  const signatures = [];
  for (const part of (header ?? '').split(',')) {
    const [key, value] = part.trim().split('=', 2);
    if (key === 't') t = Number(value);
    if (key === 'v1' && value) signatures.push(Buffer.from(value));
  }
  if (!Number.isInteger(t) || Math.abs(Date.now() / 1000 - t) > 300) return false;
  const expected = Buffer.from(createHmac('sha256', secret).update(`${t}.${rawBody}`).digest('hex'));
  return signatures.some((s) => s.length === expected.length && timingSafeEqual(s, expected));
}

import hashlib, hmac, time

def verify(secret: str, header: str | None, raw_body: bytes) -> bool:
    t, signatures = None, []
    for part in (header or "").split(","):
        key, _, value = part.strip().partition("=")
        if key == "t" and value.isdigit():
            t = int(value)
        elif key == "v1" and value:
            signatures.append(value)
    if t is None or abs(time.time() - t) > 300:
        return False
    expected = hmac.new(secret.encode(), f"{t}.".encode() + raw_body, hashlib.sha256).hexdigest()
    return any(hmac.compare_digest(s, expected) for s in signatures)

import (
	"crypto/hmac"
	"crypto/sha256"
	"encoding/hex"
	"math"
	"strconv"
	"strings"
	"time"
)

func Verify(secret, header string, rawBody []byte) bool {
	var t int64 = -1
	var signatures []string
	for _, part := range strings.Split(header, ",") {
		key, value, _ := strings.Cut(strings.TrimSpace(part), "=")
		switch key {
		case "t":
			if n, err := strconv.ParseInt(value, 10, 64); err == nil {
				t = n
			}
		case "v1":
			if value != "" {
				signatures = append(signatures, value)
			}
		}
	}
	if t < 0 || math.Abs(float64(time.Now().Unix()-t)) > 300 {
		return false
	}
	mac := hmac.New(sha256.New, []byte(secret))
	mac.Write([]byte(strconv.FormatInt(t, 10) + "."))
	mac.Write(rawBody)
	expected := hex.EncodeToString(mac.Sum(nil))
	for _, s := range signatures {
		if hmac.Equal([]byte(s), []byte(expected)) {
			return true
		}
	}
	return false
}

curl -X POST "https://elsin.io/api/v1/webhooks" \
  -H "Authorization: Bearer $ELSIN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "target_url": "https://hooks.zapier.com/…", "event": "application.created" }'

HTTP/1.1 201 Created
{
  "data": {
    "id": "9c2e…",
    "target_url": "https://hooks.zapier.com/…",
    "events": ["application.created"],
    "secret": "whsec_…"
  }
}

curl -X DELETE "https://elsin.io/api/v1/webhooks/9c2e…" -H "Authorization: Bearer $ELSIN_API_KEY"
HTTP/1.1 204 No Content

npm install -g https://elsin.io/downloads/elsin-cli.tgz

elsin login --url https://elsin.io     # shows a code; approve it in your browser
elsin whoami
elsin jobs ls --status open
elsin candidates ls --verified --job <job_id> --all
elsin review ls
elsin review decide <candidate_id> --action request_verification --note "Asked for ID check"
elsin jobs ls --all --json | jq '.[].title'