How to build a talent directory and profiles

Talent visibility is not a boolean. Read board.context().talentDirectoryVisibility and handle public, employers_only, and off states as different products. The API remains authoritative when a visitor’s access changes.

Gate the route from board context

12345678
const context = await board.context();

if (context.talentDirectoryVisibility === 'off') {
  return { notFound: true };
}

const requiresEmployer =
  context.talentDirectoryVisibility === 'employers_only';

For an employer-only directory, anonymous visitors should see a sign-in or plan explanation rather than an empty grid.

Public profiles require an explicit product policy and candidate consent; visibility must never be inferred from the presence of profile data. Employer-only directory and profile routes should be noindex, excluded from sitemaps, fetched with no-store, and absent from every shared cache. If an employer’s entitlement changes, re-read access before returning any profile fields.

Search and paginate talent

1234567891011121314
const talent = await board.talent.list(
  {
    query: searchParams.query,
    skills: searchParams.skills,
    limit: 24,
    cursor: searchParams.cursor,
  },
  {
    cache: requiresEmployer ? 'no-store' : undefined,
    headers: accessToken
      ? { authorization: `Bearer ${accessToken}` }
      : undefined,
  },
);

Carry an opaque nextCursor forward unchanged. Never decode it into page numbers. Employer-only results are private even when two employers happen to receive the same candidates.

Render a talent profile

123456
const profile = await board.talent.retrieve(handle, undefined, {
  cache: requiresEmployer ? 'no-store' : undefined,
  headers: accessToken
    ? { authorization: `Bearer ${accessToken}` }
    : undefined,
});

Render only fields returned by the visibility policy. Do not infer or reconstruct hidden contact details. Map missing profiles to 404 and access denials to the employer sign-in or upgrade path appropriate to the board.

Explain to candidates which fields are public, employer-only, or private; how talent search and any automated matching use those fields; and how to change visibility or request deletion. Do not add client-side enrichment that reconstructs data the API withheld.

Start a conversation

When an authenticated employer may contact talent, use board.me.conversations.start and keep the response private. The candidate handle identifies the conversation subject; the server checks the employer relationship and entitlements.

Verify the talent journey

1. Exercise public, employer-only, and off configurations.
2. Confirm an anonymous visitor cannot receive employer-only profiles from HTML, RSC payloads, or cache hits.
3. Follow a cursor through at least two pages and confirm no repeated profiles.
4. Open a missing handle and confirm a native 404.
5. Start a permitted conversation, then test a user without employer access and confirm a typed denial.
6. Withdraw candidate consent and confirm the profile leaves HTML, API results, internal links, sitemaps, and caches together.

Continue with Candidate account for the candidate-owned side of the marketplace.