Authentication
All requests use your FetchLayer API key as a Bearer token. There is no Upwork account to create and no OAuth flow — this reads the job postings Upwork publishes to anyone.
Sending requests
bash
curl -X POST https://api.fetchlayer.dev/upwork/search-jobs \
-H "Authorization: Bearer ss-your-key" \
-H "Content-Type: application/json" \
-d '{"query":"python developer","limit":5}'Keep your key secret
Only use API keys in server-side code and rotate a key immediately if it is exposed.
Every route is a POST
Every route takes a JSON body over POST, so nothing travels in a URL. The body is a strict object: an unrecognised field is rejected with a 400 naming it rather than quietly ignored, so a typo never returns silently wrong data. Both reading routes also carry a cross-field rule — /search-jobs needs query or searchUrl, /job-detail needs jobId or jobUrl — and an empty body is answered in about 80ms with the rule quoted back at you.
Authentication errors
A missing or invalid key returns HTTP 401. A key scoped to other platforms returns HTTP 403.
json
{
"error": "Invalid API key"
}