Authenticate to the TempWorks OpenAPI and create/read a candidate record

Steps

1. Get credentials: contact your TempWorks account manager for an AccountSid/AuthToken pair (Basic Auth) or register an application to get a client_id/client_secret for OAuth2.
2. For automated/server integrations, request a bearer token as a 'Service' user by POSTing to https://login.ontempworks.com/connect/token with grant_type=tw_vendor_service_credentials, client_id, client_secret, and acr_values set to 'tenant:{tenant} pid:{product-instance-id}' (the tenant identifies the specific TempWorks customer, pid identifies your app instance for that customer).
3. Alternatively use HTTP Basic Auth directly against the API with your AccountSid as username and AuthToken as password.
4. Call the API against base URL https://api.ontempworks.com/, sending 'Authorization: Bearer {token}' if using OAuth2, or the x-tw-token header (base64 of AccountSid:AuthToken) if using token auth.
5. To create a candidate, POST to the candidates endpoint with at minimum first name, last name, region (state), and branch — this endpoint intentionally bypasses assignment-restriction validation and marks the resulting record with an 'applied from web' status.
6. To read candidate data, use the swagger/ReDoc reference at https://api.ontempworks.com/swagger or https://api.ontempworks.com/api-docs to find the exact candidate GET routes, and use documented query params (skip/take) for paging.