Authentication

Every request to the CRE GraphQL API must include an Authorization header carrying a CRE API key.

Creating an API key

API keys for CRE are created from app.chain.link, not from the GraphQL API itself.

1. Create an account or sign in to app.chain.link.

2. Click on your account's icon in the top-right corner of the navbar and go to Org settings to open the Organization page, then navigate to the API Keys tab.

3. Click Create API Key and enter a name for the key.

4. In the API Scope section, expand the CRE accordion and grant the key the permissions that the CLI uses. For the Organization permission, expand the Chainlink Platform accordion.

   Name	Action	Permission ID
   Workflow	Read	cre:workflow:read
   Workflow	Write	cre:workflow:write/private_registry
   Workflow artifact	Read	cre:workflow:artifact:read
   Workflow artifact	Write	cre:workflow:artifact:write
   Owner address linking	Write	platform:owner_address:linking:write/cre

   See API Keys for the full list of permissions available for CRE.

5. Click Create API Key, then copy the key and click Done. The API key is displayed only once.

This is the same key used for CRE_API_KEY with the CRE CLI. For the full walkthrough, see API key authentication in the CLI reference.

Sending the API key

Send the key in the Authorization header using the Apikey scheme — not Bearer:

Authorization: Apikey <CRE_API_KEY>

cURL

curl -X POST \
  https://api.cre.chain.link/graphql \
  -H "Content-Type: application/json" \
  -H "Authorization: Apikey <CRE_API_KEY>" \
  -d '{
    "query": "query { getAccountDetails { memberId displayName emailAddress } }"
  }'

TypeScript

const response = await fetch("https://api.cre.chain.link/graphql", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    Authorization: `Apikey ${process.env.CRE_API_KEY}`,
  },
  body: JSON.stringify({
    query: `query { getAccountDetails { memberId displayName emailAddress } }`,
  }),
})

const result = await response.json()

Go

package main

import (
	"bytes"
	"encoding/json"
	"fmt"
	"net/http"
	"os"
)

func main() {
	reqBody, _ := json.Marshal(map[string]string{
		"query": `query { getAccountDetails { memberId displayName emailAddress } }`,
	})

	req, err := http.NewRequest("POST", "https://api.cre.chain.link/graphql", bytes.NewBuffer(reqBody))
	if err != nil {
		panic(err)
	}
	req.Header.Set("Content-Type", "application/json")
	req.Header.Set("Authorization", "Apikey "+os.Getenv("CRE_API_KEY"))

	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer resp.Body.Close()

	var result map[string]any
	json.NewDecoder(resp.Body).Decode(&result)
	fmt.Println(result)
}

Invalid or missing credentials

If the Authorization header is missing, malformed, or carries an invalid or expired key, the request fails authentication. See Errors & Rate Limits for how to detect and handle this in your client — check both the HTTP status code and the response body's errors array, since either can carry the failure.

Related

• Quickstart
• Requesting Deploy Access
• CLI: API key authentication