Authentication

Every request to the CRE GraphQL API must include an Authorization header carrying a CRE API key.

Creating an API key

API keys for CRE are created from app.chain.link, not from the GraphQL API itself.

1. Sign in to the Chainlink Platform, click your account icon in the top-right corner of the navbar, and click Org settings in the dropdown to open the Organization page, then open the API Keys tab.
2. Click Create API Key and enter a name for the key.
3. In the API Scope section, expand the CRE accordion and set its preset to All. This grants the following permissions. See API Keys for the full list of permissions available for CRE.

1. Click Create API Key, then copy the key and click Done. The API key is displayed only once.

This is the same key used for CRE_API_KEY with the CRE CLI. For the full walkthrough, see API key authentication in the CLI reference.

Sending the API key

Send the key in the Authorization header using the Apikey scheme — not Bearer:

Authorization: Apikey <CRE_API_KEY>

cURL

curl -X POST \
  https://api.cre.chain.link/graphql \
  -H "Content-Type: application/json" \
  -H "Authorization: Apikey <CRE_API_KEY>" \
  -d '{
    "query": "query { getAccountDetails { memberId displayName emailAddress } }"
  }'

TypeScript

const response = await fetch("https://api.cre.chain.link/graphql", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    Authorization: `Apikey ${process.env.CRE_API_KEY}`,
  },
  body: JSON.stringify({
    query: `query { getAccountDetails { memberId displayName emailAddress } }`,
  }),
})

const result = await response.json()

Go

package main

import (
	"bytes"
	"encoding/json"
	"fmt"
	"net/http"
	"os"
)

func main() {
	reqBody, _ := json.Marshal(map[string]string{
		"query": `query { getAccountDetails { memberId displayName emailAddress } }`,
	})

	req, err := http.NewRequest("POST", "https://api.cre.chain.link/graphql", bytes.NewBuffer(reqBody))
	if err != nil {
		panic(err)
	}
	req.Header.Set("Content-Type", "application/json")
	req.Header.Set("Authorization", "Apikey "+os.Getenv("CRE_API_KEY"))

	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer resp.Body.Close()

	var result map[string]any
	json.NewDecoder(resp.Body).Decode(&result)
	fmt.Println(result)
}

Invalid or missing credentials

If the Authorization header is missing, malformed, or carries an invalid or expired key, the request fails authentication. See Errors & Rate Limits for how to detect and handle this in your client — check both the HTTP status code and the response body's errors array, since either can carry the failure.

Related

• Quickstart
• Requesting Deploy Access
• CLI: API key authentication