Skip to main content

Data & Auth

  • Database: PostgreSQL via Drizzle ORM (packages/db), Supabase-hosted.
  • Browser sessions: Supabase Auth JWTs.
  • MCP / CLI access: a separate credential kind — ofmcp_-prefixed service tokens, minted via Settings → MCP Connections in the web app, verified independently by apps/api on every request (see The Jobweave Claude Code Skill and the MCP Tool Reference).

Scope vocabulary​

15 scopes, per-resource-and-verb rather than blanket. A token can hold applications:read without resumes:read — a tool is only registered on a connection if that connection's token carries the scope it needs.

applications:read · applications:write · resumes:read · resumes:write · library:read · library:write · identities:read · identities:write · repositories:read · repositories:write · cover-letters:read · cover-letters:write · tasks:read · tasks:write · ai:generate

Source: packages/mcp-tool-server/src/core/constants.ts.

What a 401 means​

A 401 means the credential is invalid — expired, revoked, or malformed. The server deliberately does not distinguish which, so don't try to recover mid-request; mint a fresh token instead.