Developer guide

Browser access

1. Open Settings in the desktop app.
2. Under Browser access, generate a code.
3. Open API docs and enter the code within two minutes.

Each code works once. Browser access lasts up to eight hours and ends when you log out, revoke browser access, quit CTE, or reach the session limit. Codes and browser sessions do not survive an app restart. Ordinary new tabs need a new code. Duplicating an authorized tab can copy its session, and those tabs share logout, revocation, and expiry.

The browser stores its short-lived credential in sessionStorage. CTE does not put codes or credentials in URLs, cookies, localStorage, generated examples, or static files.

Create an integration token

1. In Settings, find Integrations and enter a name.
2. Choose Read only or Read and process candidates.
3. Select Create token and save the token when it appears. CTE cannot show it again.

Read only can access supported jobs, candidates, and documents. Read and process candidates can also start paid AI processing without asking again in CTE. CTE does not enforce a spending cap for an integration. Integration tokens survive app restarts and remain valid until revoked.

Address changes and local development

CTE prefers port 8787 but may choose another port. If a connector cannot reach CTE, copy the current address from Settings.

For source development, run the source desktop app against a current built UI. The standalone API accepts an existing integration token but cannot create an owner browser session without the trusted desktop process. Separate Vite origins are not authorized.

Local listener limitation

A malicious local process could bind CTE's old port while CTE is stopped and imitate the listener to collect a credential. Loopback checks, CORS, health responses, and version responses do not prove server identity. Use integrations only on a trusted personal computer.

Use the current API address

Copy the numeric loopback address shown in Settings. The port can change, so do not guess or scan for it. Reject redirects and never send a credential while discovering an address.

Replace the placeholders below with the address and token you copied:

CTE_API_ADDRESS=http://127.0.0.1:8787
CTE_INTEGRATION_TOKEN=<your-integration-token>
curl --fail --max-redirs 0 \
  --header "Authorization: Bearer ${CTE_INTEGRATION_TOKEN}" \
  "${CTE_API_ADDRESS}/jobs"

This read-only request lists jobs. A bearer token authorizes the request, but it does not prove the identity of the local server. Use integrations only on a trusted personal computer.

Replace or revoke a token

If a token is lost, create a replacement, update and test the connector, then revoke the old token. Revocation blocks its next authorization check. Work already accepted may finish.