Skip to main content

Authentication

All API requests require authentication via API key. API keys are tied to your Crowd.Credit account and can be managed through the dashboard.

API Key Authentication​

Include your API key in the X-API-Key header with every request:

curl -H "X-API-Key: your_api_key_here" \
  https://api.crowd.credit/api/v1/accounts/me

Obtaining an API Key​

  1. Log in to the Crowd.Credit App
  2. Navigate to Settings > API Keys
  3. Click Create API Key
  4. Give your key a descriptive name
  5. Copy the key immediately -- it will only be shown once

Key Management​

Permissions​

API keys can be scoped with specific permissions:

PermissionDescription
readRead-only access to account data
writeCreate and modify resources
adminFull access including key management

Rotation​

We recommend rotating API keys every 90 days. To rotate:

  1. Create a new API key
  2. Update your application to use the new key
  3. Verify the new key works
  4. Delete the old key

Revoking Keys​

You can revoke an API key at any time:

  • Via Dashboard: Settings > API Keys > Revoke
  • Via API: DELETE /api/v1/keys/{keyId}

Revoked keys are immediately invalidated.

Security Best Practices​

  • Never expose API keys in client-side code -- keys should only be used server-side
  • Use environment variables -- don't hardcode keys in source code
  • Set minimum permissions -- only grant the permissions your application needs
  • Monitor usage -- review API key activity regularly for unauthorized access
  • Use IP allowlists -- restrict API key usage to known IP addresses when possible

Next Steps​