Loxo API: Developer Guide, Access, Limits, and 100Hires Comparison 2026 - 100Hires

Getting productive with the Loxo API means clearing three hurdles up front: gated access, thin operational docs, and response shapes you learn by calling. This guide covers all three.

The API itself is a bearer-token REST interface to Loxo, the recruiting CRM and ATS, and its reference lists 202 method-labeled reference pages as of July 2026, webhooks included.

This guide walks through the parts that matter before you write code: how access works, how auth works, what the endpoint surface covers, what the rate limits are, what webhooks and the new MCP server can do, and where integrators report friction.

A note on scope. We found no numeric rate limit and no full downloadable spec in the Loxo docs we checked in July 2026, so part of this guide documents what is not documented.

Claims link to their live sources or name them inline, checked in July 2026. This guide is part of our ATS API series.

Key takeaways

Every figure below is sourced and linked in its own section further down.

• Broad and active: 202 method-labeled reference pages across roughly 84 resource groups, deals and placements included. API changes appear in 6 of the last 7 monthly release notes, and an official MCP server entered beta in June
• Gated access: the API is a paid feature on an active subscription. The API Keys page is enabled by Loxo Support, and external developers join a Developer Program
• Auth: bearer token plus an agency-domain and agency-slug URL pattern
• Docs gaps: the help guide documents 24 operations of that surface. Response schemas were empty on all 10 endpoints we sampled, and no numeric rate limit appears in the docs we checked
• Webhooks: they run in production, but the docs we searched include no payload example or signing scheme, and webhooks accept API-key auth only
• 100Hires contrast: self-serve keys included on all plans, a public OpenAPI 3.1 spec with 89 paths and 133 operations, a documented 100 requests per 10 minutes limit, HMAC-signed webhooks. Smaller surface, no CRM objects. 100Hires is our product, and the comparison below is row-by-row verifiable

How do you get Loxo API access and an API key

Plan for an access-request step before you write any code. Loxo's own Open API guide states that API access is a paid feature tied to an active subscription, and it points non-customers to a demo call rather than a signup form.

Two more gates sit behind that one. The Settings page for API keys is admin-only, and if the option is missing from your account, the guide tells you to ask Loxo Support to enable it. External developers and vendors go through a Developer Program, again via Loxo Support.

For an existing Loxo customer, the working sequence looks like this:

1. Log in as an account admin
2. Open Settings, then API Keys. If the page is absent, request it from Loxo Support
3. Generate a key
4. Find your agency slug. Partner setup guides use the path segment of your Loxo careers page URL, and Metaview's guide suggests asking Loxo Support for it. Note your agency domain too
5. Store the key somewhere safer than a code repo

Which plan includes the API? The Loxo pricing page lists a Free single-user tier at $0, Basic at $169 per user per month billed annually ($209 monthly), and quote-only Professional and Enterprise tiers.

The API is not mentioned on any tier, so confirm entitlement with your account manager before you commit engineering time.

A formal Developer Sandbox exists as a legal construct. Its Terms of Use, dated August 2022, govern sandbox accounts and restrict access by Loxo's direct competitors, and competitive testing needs written consent. We found no public request flow for it in the docs we crawled.

How do you authenticate and make your first request

Auth is a bearer token in the Authorization header. Every endpoint URL is built from your agency domain and agency slug, a pattern the Open API guide spells out. A first request looks like this:

curl -s "https://app.loxo.co/api/{agency_slug}/jobs" \
  -H "Authorization: Bearer YOUR_API_KEY"

Swap in your own domain if your agency runs on one. The scheme trips people up in practice: a public Stack Overflow question shows a developer sending Basic auth against the job-apply endpoint and failing. The question drew one low-detail answer.

The fix is a plain Bearer header.

The Open API guide explains the causes of 403 responses in detail, including calls to paths outside the Open API contract such as /api/v1/people and /api/v1/jobs.

No other error code is documented in that guide, so log every status code you receive in development.

Pagination deserves attention early. Styles differ by resource: the jobs list is page-based, with page and per_page params and results under a "results" key.

The companies list is scroll-based, with a scroll_id and results under a "companies" key, and it returns HTTP 422 if you send per_page. A community CLI project documented this exact mismatch in a fixed-and-closed issue, and the endpoint specs corroborate it.

One question about sorting paginated results remains open. The one public pagination question about sort order breaking across pages never got an answer, so verify sort behavior client-side.

Budget for response shapes too. In Loxo's own endpoint specs, all 10 reference pages we sampled declare an empty response schema, and request schemas are richly typed at the same time. The request body for creating a person documents more than 40 fields.

In plain terms, you know exactly what to send, and you learn what comes back by calling. Log full responses in development. Community clients document learned response shapes and workarounds.

Which endpoints and resources does the Loxo API cover

The surface is broad. The reference on readme.io holds 202 method-labeled reference pages across roughly 84 resource groups.

The root reference page itself rendered nearly empty when we fetched it, about 61 visible words, so the practical index is the machine-readable llms.txt file, which listed 202 operation pages at our July 2026 check.

The breadth includes CRM objects layered on the ATS core: deals, placements, placement splits, and scorecards. If your agency workflow spans business development and placements, that coverage is a real advantage of building on Loxo.

Know one architecture choice up front. The candidates resource supports read and update, but it has no create endpoint. Person records are created through the people resource and then attached to jobs.

Model your integration around that split.

The help guide's use-case section documents 24 operations across 16 path templates of that surface. Use the help guide as a starting point and the reference for the rest of the documented surface.

The docs do move: February release notes say the API documentation was updated, and recent months added enrichment endpoints, a candidate-deletion endpoint, webhook document types, and higher-concurrency webhook delivery.

Loxo brands the product a Talent Intelligence Platform rather than a plain ATS, and the API reflects that scope.

A licensing detail matters for data work: profiles sourced through Loxo Source return only person_name, person_id, and custom fields through the API, per Loxo's own wording. Data your team imported is fully retrievable.

What are the Loxo API rate limits

Here is the honest answer: no numeric rate limit is published anywhere we checked.

That covers the Open API guide, 10 sampled reference pages, the llms.txt index, the developer terms, the marketplace page, the pricing page, and all 7 recent monthly release notes, reviewed in July 2026.

The single rate-limit mention we found sits in the April release notes, which added limits to Loxo Source profile imports as an anti-abuse measure. No number is given there either.

Truto's Loxo integration FAQ raises rate limiting, then answers only that Truto abstracts it away.

So treat the ceiling as unknown. Build exponential backoff on 429 and server-error responses from day one, cache reads, and schedule bulk syncs in windows. For contrast, documented limits do exist in this category.

The 100Hires API publishes 100 requests per 10 minutes with X-RateLimit headers, and the full comparison sits below.

What do Loxo webhooks cover, and what is missing

Webhooks exist and are manageable through the API: you register an endpoint URL for an item type, with create, update, and destroy as the event actions. On coverage, two current Loxo sources disagree.

The webhook-create endpoint spec lists a 16-value item-type enum, and the help guide lists 10 types. Check the spec for your item type before you architect around it.

There is an auth seam to plan around. Webhook endpoints accept API-key auth only. Loxo's MCP server signs in over OAuth, and both the endpoint spec and the MCP article's error table state that webhooks cannot be managed over that connection.

Two auth paths, one of them webhook-capable.

What the help guide and endpoint specs we searched do not include: a payload example, a signing or verification scheme, and a retry policy. Consumers will need to capture live payloads to learn shapes, and there is no documented signature to validate deliveries against.

At least one recruiting firm uses the webhooks in production.

A recruiting-firm founder documents his live build: Loxo fires POST requests on 9 monitored event types, and the payload travels through a Cloudflare Tunnel to a local Node.js server.

His server then fetches enriched person data back from the API, notifications land in under 2 seconds, and every event is logged to daily JSONL files.

Loxo keeps developing its webhook support: the March release notes added document webhooks for 6 more types, and June notes described higher-concurrency delivery.

Ecosystem note: Unified.to states it extended its virtual webhook coverage for Loxo. If you want to see how a signed, documented webhook contract looks on an ATS core, our webhooks integration page shows the 100Hires version.

What about the Loxo MCP server

The newest development in the release notes we reviewed came in June, when Loxo announced The Loxo MCP in beta. The MCP article gives a server URL of app.loxo.co/api/{agency_slug}/mcp, OAuth sign-in, and compatibility with Claude, ChatGPT, and Cursor.

It supports read and write actions, permanent deletes included, and Loxo recommends reviewing AI-generated actions before approving them.

Credit where due: the same article documents its own beta limits. Some endpoints return HTML 500 error pages, and write endpoints are unreliable. Loxo advises using the beta mainly for reads for now.

Schedule items return empty results, and webhooks cannot be managed over MCP.

That level of candor about a beta is useful to an integrator.

A community MCP server with 34 tools exists on GitHub, and a third-party RecruiterClaw video demonstrates MCP-driven Loxo workflows, from listing pipeline IDs to moving candidates between stages.

Loxo's own MCP teaser videos carry no narration.

Both vendors now ship MCP servers. 100Hires lists its MCP server on the API docs page, so the comparison below sticks to the REST APIs.

Where developers actually hit friction

First, a disclosure about the evidence. Public developer chatter on the Loxo API is scarce. Reddit has zero threads for the exact phrase, and exactly 3 of Loxo's 168 reviews on G2 match the keyword API (G2's own keyphrase filter, checked July 2026).

What follows is the friction that is on the record: Loxo's own docs, GitHub integrator projects, and a few first-person accounts.

The three G2 reviews are mixed. A 2022 review from an agency co-founder building a recruiting SaaS product found the API fell short of what that product needed. Two 2020 reviewers praised Loxo for enhancing the API to meet their requirements.

This is a small, mixed sample, but it is the complete set of G2 reviews matching that keyword.

GitHub carries the most concrete evidence. The loxo-cli project fixed and documented the per-resource pagination mismatch covered above, plus a jobs-list crash on nested status objects.

The owlkit client's README reads as one integrator's field notes: a text search that returns the entire database on a miss, Lucene field:value queries that return nothing silently, and special characters that trigger 400s.

The same notes list contact details behind separate sub-endpoint calls, tag writes that are silently ignored, and list management that exists only in the UI.

These are one builder's field notes, not a universal verdict, but they are useful when estimating an integration.

Docs drift shows up in one first-person account. An independent Chrome-extension builder reported finding through trial and error that an education-upload call required a different format from the one shown in the documentation.

A single account, offered as illustration.

Our five YouTube searches found no first-party developer tutorial. Every hands-on API demo we found was a partner setup video showing the key-and-slug flow, including videos from Hireflix, KrispCall, Honeit, and similar tools.

Some adjacent, product-level context. Offboarding threads on Reddit describe vendor-managed migration fees, one user cited about $3,000, and a data-access dispute mid-contract.

How does the 100Hires API compare

Full disclosure first: 100Hires is our product. So this section skips adjectives and sticks to rows you can verify against both vendors' live documentation. Sources are noted under the table.

The short version: Loxo documents more method-labeled operation pages and includes CRM objects. The 100Hires API provides self-serve access and documents its rate limits, webhook signing, and pagination.

Table sources: the Loxo help guide, endpoint reference, pricing page, and developer terms, and the 100Hires openapi.json spec and API docs page, linked or named earlier in this article.

Integration counts come from the 100Hires internal integrations catalog and Loxo's public marketplace page. Checked July 2026.

The honest limitations on our side. The 100Hires surface is materially smaller, 133 operations against 202 method-labeled reference pages, and it has no deals, placements, or CRM objects.

The product has no agency-CRM layer, so those objects have nothing to map to. Webhooks lack an update operation, so you delete and recreate.

The default rate limit is modest until support raises it.

We document no sandbox environment, and auth is Bearer keys, with no OAuth found in the sources we inspected. Our integration count is 19 against the 45 listed on Loxo's marketplace. Keys stay inactive until your company passes verification.

Which API fits which use case? If your agency uses Loxo and needs API access to deals, placements, and scorecards, Loxo provides those resources, but you must complete its access process.

If you want a self-serve key, an importable Postman spec, and documented limits, signing, and pagination, 100Hires provides them, but its API documents fewer operations, 133 against 202 reference pages, and no CRM objects.

Create a 100Hires account and generate a key under Settings, then Integrations, then API Keys. API access is included on all plans at no extra cost, and keys activate once your company passes verification.

Frequently asked questions

Does Loxo have an API?

Yes. Loxo's Open API uses bearer-token auth and its reference lists 202 method-labeled reference pages as of July 2026, webhooks included. Access is a paid feature arranged through Loxo Support. For contrast, 100Hires publishes a full OpenAPI 3.1 spec you can import into Postman at api.100hires.com/v2/openapi.json.

How do I get a Loxo API key?

Generate one under Settings, then API Keys, as an account admin. If the page is missing, ask Loxo Support to enable it, and note that access requires an active paid subscription. 100Hires keys are self-serve on any plan once your company passes verification.

What are the Loxo API rate limits?

No numeric rate limit appears in the Loxo docs we checked as of July 2026, so build backoff and treat the ceiling as unknown. The 100Hires API documents 100 requests per 10 minutes per key, with X-RateLimit headers and support-raisable limits.

Does Loxo have webhooks?

Yes, with API-key-only auth and create, update, and destroy actions. The endpoint spec lists 16 item types and the help guide lists 10, so check the spec for yours. No signing docs were found. 100Hires webhooks are HMAC-signed with a documented payload example.

Does Loxo have an MCP server?

Yes, an official beta since June, with OAuth sign-in, read and write actions, and self-documented beta limits such as unreliable writes. 100Hires ships an MCP server as well, listed on its API docs page.

Is Loxo an ATS or a CRM?

Both in one platform. Loxo brands itself a Talent Intelligence Platform spanning ATS, CRM, and sourcing. 100Hires focuses on the ATS core, with API access included on every plan at no extra cost.

How much does Loxo cost?

Loxo lists a Free single-user tier, Basic at $169 per user per month billed annually or $209 monthly, and quote-based Professional and Enterprise tiers. Whether a tier includes API access is not publicly stated. 100Hires includes API access on all plans at no extra cost.