Developer — xChk

Register an app

App name Client ID (optional) Redirect URIs (one per line)

Add /oauth/playground.html to test grants without deploying a callback.

New apps start unverified — users see a warning on the consent screen until your app is verified (domain proof, business verification). Contact support to verify.

Endpoints for your app:

Your apps

OIDC endpoints

Discovery
/.well-known/openid-configuration

Authorize
/oauth/authorize

Token
/oauth/token

JWKS
/oauth/jwks

Userinfo
/oauth/userinfo

Public clients must use PKCE (S256). Exchange codes on your server, not in the browser.

Greenhouse not connected

▸How it works

Paste a Harvest v3 API credential from your Greenhouse Dev Center (API Credential Management → Harvest v3). We verify it with one read and create three candidate fields in your Greenhouse if they are missing — xChk verification link (the candidate's page), xChk interview link (the interviewer's page, candidate pre-loaded) and xChk receipt (written at close) — each with an email token for your templates. Then create the webhook below: every candidate a recruiter adds or edits gets their links within seconds. Nothing runs on a timer; Sync now reads scheduled interviews on demand (interviewers, the location line). Permissions: custom-fields write only while you set up, then candidates read/write, applications and users read, interviews read — the full table is in the integration guide.

Client ID Client secret Candidates are owned by (xChk user email) Custom field keys: verification · interview · receipt

enabled

API & Webhooks

Helpdesk / HR

Enrollment invitations from your ATS or helpdesk, and the systems that sync candidates and tickets: Zendesk, Greenhouse, Ashby and LinkedIn have their own tabs above.

Invite enrollments from external systems with an API key. Optional webhook receives batch results.

Webhook URL Webhook secret (optional, for HMAC signature)

API keys

Named keys help audit which integration called the API.

Copy this key now — it will not be shown again:

External endpoint: POST /api/v1/preregister/invites with header X-API-Key and body { "emails": ["a@x.com"] }

Test webhook sink: https://in.xchk.io/api/webhooks/test (logged on server)

Company SSO — Login with Microsoft Entra

Your team signs in with the Continue with Microsoft button on the sign-in page — any Microsoft Entra work or school account, with no setup and no separate xChk password. Those sign-ins are linked to your organization's tenant automatically.

Recruiter SSO & signed launch (LinkedIn)

Separate from company sign-in above. Connect LinkedIn to verify the recruiter, then launch helpdesk from candidates.html or your ATS with a signed link. Steps 1–3 are this one flow.

1. LinkedIn

2. Enable signed launch

Enable SSO launch from candidates / ATS

3. Mint launch URL

Server endpoint (requires integrator API key and SSO enabled):

POST /api/integrator/sso/mint-launch with header X-API-Key

Body: { "email": "candidate@example.com", "mobile": "+15551234567", "candidateId": "...", "linkedinId": "username", "operatorEmail": "recruiter@company.com", "operatorName": "Jane Recruiter" }

Returns a signed launchUrl (15 min TTL) that opens helpdesk with subject context pre-filled.

Test launch URL (expires in 15 minutes):

Connect Zendesk for PASS/FAIL ticket sync and install the sidebar app for agents.

1. Connect Zendesk subdomain

2. Download xChk app

Download zendesk-xchk-app.zip

3. Upload App

Upload in Zendesk Admin

4. Add integrator token ?

API key for Zendesk to access xChk — set this in xchk_integrator_token in the Zendesk app settings. Keys are named zd-subdomain-1, etc.

Copy this key now — it will not be shown again:

Create API keys for AI agents and automation to request human attestations. Each key has its own webhook URL where results are sent.

Create an API key

Webhook URL — results POSTed here when an attestation using this key is responded to

Copy this key now — it will not be shown again:

Existing keys

Each key sends results to its own webhook URL. Click a key to edit its webhook.

API reference

Send an attestation request using an API key:

curl -s -X POST "https://in.xchk.io/api/attestations"   -H "X-API-Key: your_key_here"   -H "Content-Type: application/json"   -d '{"user":"user@company.com","prompt":"Approve $5,000 payment to Vendor X","type":"t/f","ttl":3600}'

ttl is seconds until expiration (default 600, max 86400).

On response, results are POSTed to the key's webhook URL with payload: { event, attestation_id, target_email, prompt, response, ... } — signed with the key's webhook secret.

Since 18 Oct 2026 the signed webhook sink (Integrations → AI) is this callback's successor: one endpoint receives every finding — refusals, holds, approvals and denials with their receipts, gate drops, omissions, revocations — as signed CloudEvents, with a delivery log and retries. This per-key callback keeps working for the keys that have one.

Results are also POSTed to the key's webhook URL. Configure Slack or Telegram under Profile → About me.

Ashby not connected

▸How it works

Paste an Ashby API key (Admin → Integrations → API Credentials → New; leave Integration Partner empty). We verify it with one read, create three candidate fields if they are missing — xChk verification link (the candidate's page), xChk interview link (the interviewer's page, candidate pre-loaded) and xChk receipt (written at close) — and register our webhooks with Ashby for you: applicationSubmit, interviewScheduleCreate, interviewScheduleUpdate. When an interview is booked, its interviewers are admitted and both links land on the candidate within seconds. At close, the receipt field is filled and a note with the rating and the history link is added to the candidate. Nothing runs on a timer; Sync now reads live interview schedules on demand. Key permissions: .

Then, in Ashby (two things xChk cannot do for you):
1. Custom Fields → Candidate → xChk interview link and xChk verification link → tick Enable in Email Templates.
2. Scheduling Defaults → Communication → add the tokens with the editor's T button: [Custom field] xChk interview link in the Invite to Interviewers template, [Custom field] xChk verification link in the Invite to Candidate template.
Invites go out through the scheduler's connected calendar — "Pending invites" on a schedule means Ashby has not sent them. Preview shows N/A instead of the link? Press Sync now and reload the scheduling page.
Full setup guide →

API key Candidates are owned by (xChk user email)

enabled

Connectors: where a finding goes

Every finding the registry makes about a plate — an act refused or held, an approval or denial with its receipt, a gate dropped, the coverage lamp going red, a plate revoked — is pushed to each sink below, with the record hash and the receipt URL so the SIEM holds pointers into evidence. Three retries over about twenty minutes; every attempt is in the delivery log. The per-key attestation webhook on the Attestations tab is this signed webhook's predecessor: it answers one API key's requests; a sink here receives every finding. How each sink is set up.

Sinks

Loading…

This registry cannot store sink credentials yet: the operator has not set its connector key. Sinks with a secret cannot be added until then.

No sinks yet. Add one and send a test finding before saving — the receiver proves the wire.

New sink

Where

Label

Findings

None ticked = every kind.

Minimum severity

Plates (optional, comma-separated)

Empty = every plate of yours.

Name the accountable person in each finding

Our findings carry the approver's address by design — the person is the point. Untick for a receiver that must not hold personal data; the receipt still names them.

Delivery log

When	Finding	Sink	Status	Attempts	Response

Nothing delivered yet.

Shared Signals (SSF / CAEP) no streams

▸How it works

This registry is a Shared Signals Framework transmitter. Open a stream to a receiver and every verdict that was not a silent allow — refused, held for a person, approved or denied by a named person — leaves as a signed Security Event Token (https://xchk.io/secevent/decision, with the record hash, previous hash, attestation hash, approver and auth method). An emergency stop is a CAEP session-revoked per plate; a plate revoked or re-issued is a CAEP credential-change. The subject is the plate; the person rides inside the event.

Receivers verify tokens against . Transmitter metadata: . Push = we POST each SET to your https endpoint (RFC 8935, optional Authorization header, retries with backoff). Poll = your receiver calls POST /api/ssf/poll with the bearer shown once at creation (RFC 8936; ack with {"ack":["jti"]}).

OCSF export: any plate's window as OCSF 1.3 NDJSON (API Activity per record, Detection Finding per stop): GET /api/agents/<id>/ocsf?from=&to= — beside the OTel export on the plate sheet.

Receiver (a label) Delivery Endpoint URL (https) Authorization header (optional, sent verbatim) Plates (optional, comma-separated; empty = all yours) Events decisions emergency stops credential changes