Authentication
Every request to the CRE GraphQL API must include an Authorization header carrying a CRE API key.
Creating an API key
CRE API keys are created from the CRE platform UI, not from the GraphQL API itself.
- Log in to the CRE platform
- Navigate to the Organization page
- Select the APIs tab
- Click + Organization API
- Give your key a name and confirm
This is the same key used for CRE_API_KEY with the CRE CLI. For the full walkthrough, see API key authentication in the CLI reference.
Sending the API key
Send the key in the Authorization header using the Apikey scheme — not Bearer:
Authorization: Apikey <CRE_API_KEY>
cURL
curl -X POST \
https://api.cre.chain.link/graphql \
-H "Content-Type: application/json" \
-H "Authorization: Apikey <CRE_API_KEY>" \
-d '{
"query": "query { getAccountDetails { memberId displayName emailAddress } }"
}'
TypeScript
const response = await fetch("https://api.cre.chain.link/graphql", {
method: "POST",
headers: {
"Content-Type": "application/json",
Authorization: `Apikey ${process.env.CRE_API_KEY}`,
},
body: JSON.stringify({
query: `query { getAccountDetails { memberId displayName emailAddress } }`,
}),
})
const result = await response.json()
Go
package main
import (
"bytes"
"encoding/json"
"fmt"
"net/http"
"os"
)
func main() {
reqBody, _ := json.Marshal(map[string]string{
"query": `query { getAccountDetails { memberId displayName emailAddress } }`,
})
req, err := http.NewRequest("POST", "https://api.cre.chain.link/graphql", bytes.NewBuffer(reqBody))
if err != nil {
panic(err)
}
req.Header.Set("Content-Type", "application/json")
req.Header.Set("Authorization", "Apikey "+os.Getenv("CRE_API_KEY"))
resp, err := http.DefaultClient.Do(req)
if err != nil {
panic(err)
}
defer resp.Body.Close()
var result map[string]any
json.NewDecoder(resp.Body).Decode(&result)
fmt.Println(result)
}
Invalid or missing credentials
If the Authorization header is missing, malformed, or carries an invalid or expired key, the request fails authentication. See Errors & Rate Limits for how to detect and handle this in your client — check both the HTTP status code and the response body's errors array, since either can carry the failure.