Authentication

Every request to the CRE GraphQL API must include an Authorization header carrying a CRE API key.

Creating an API key

API keys for CRE are created from app.chain.link, not from the GraphQL API itself.

1. Create an account or sign in to app.chain.link.

2. Click on your account's icon in the top-right corner of the navbar and go to Org settings to open the Organization page, then navigate to the API Keys tab.

3. Click Create API Key and enter a name for the key.

4. In the API Scope section, expand the CRE section and grant the key the permissions that the CLI uses. For platform:organization:read, expand the Chainlink Platform section.

   Name	Permission	Description
   Workflow: Read	cre:workflow:read	View workflows.
   Workflow: Write (Private registry)	cre:workflow:write/private_registry	Deploy, pause, activate, and delete workflows in the private registry.
   Workflow artifact: Read	cre:workflow:artifact:read	Download workflow artifacts.
   Workflow artifact: Write	cre:workflow:artifact:write	Upload workflow artifacts, which is required to deploy a workflow.
   Owner address linking: Write (Cre)	platform:owner_address:linking:write/cre	Link and unlink workflow owner addresses, which is required to deploy workflows to the onchain registry.
   Organization: Read	platform:organization:read	View organization information.

   See API Keys for the full list of permissions available for CRE.

5. Click Create API Key, then copy the key and click Done. The API key is displayed only once.

This is the same key used for CRE_API_KEY with the CRE CLI. For the full walkthrough, see API key authentication in the CLI reference.

Sending the API key

Send the key in the Authorization header using the Apikey scheme — not Bearer:

Authorization: Apikey <CRE_API_KEY>

cURL

curl -X POST \
  https://api.cre.chain.link/graphql \
  -H "Content-Type: application/json" \
  -H "Authorization: Apikey <CRE_API_KEY>" \
  -d '{
    "query": "query { getAccountDetails { memberId displayName emailAddress } }"
  }'

TypeScript

const response = await fetch("https://api.cre.chain.link/graphql", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    Authorization: `Apikey ${process.env.CRE_API_KEY}`,
  },
  body: JSON.stringify({
    query: `query { getAccountDetails { memberId displayName emailAddress } }`,
  }),
})

const result = await response.json()

Go

package main

import (
	"bytes"
	"encoding/json"
	"fmt"
	"net/http"
	"os"
)

func main() {
	reqBody, _ := json.Marshal(map[string]string{
		"query": `query { getAccountDetails { memberId displayName emailAddress } }`,
	})

	req, err := http.NewRequest("POST", "https://api.cre.chain.link/graphql", bytes.NewBuffer(reqBody))
	if err != nil {
		panic(err)
	}
	req.Header.Set("Content-Type", "application/json")
	req.Header.Set("Authorization", "Apikey "+os.Getenv("CRE_API_KEY"))

	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer resp.Body.Close()

	var result map[string]any
	json.NewDecoder(resp.Body).Decode(&result)
	fmt.Println(result)
}

Invalid or missing credentials

If the Authorization header is missing, malformed, or carries an invalid or expired key, the request fails authentication. See Errors & Rate Limits for how to detect and handle this in your client — check both the HTTP status code and the response body's errors array, since either can carry the failure.

Related

• Quickstart
• Requesting Deploy Access
• CLI: API key authentication