# Authentication
Source: https://docs.chain.link/cre/reference/graphql-api/authentication
Last Updated: 2026-10-26

> For the complete documentation index, see [llms.txt](/llms.txt).

Every request to the CRE GraphQL API must include an `Authorization` header carrying a CRE API key.

> **NOTE: Deploy access required**
>
> Creating an API key requires your account to have deploy access approval. Run `cre account access` with the CRE CLI to
> check your status or submit a request. See [Requesting Deploy Access](/cre/guides/operations/deploy-access).

## Creating an API key

API keys for CRE are created from [app.chain.link](https://app.chain.link), not from the GraphQL API itself.

> **NOTE: Roles needed to create a CRE API key**
>
> Creating an API key requires a Platform role that includes API key permissions: Platform User, Platform Admin, or Owner. You can only give a key permissions that your own roles include, so to grant the CRE permissions below you also need the CRE Admin role. CRE Developers can grant every permission below except owner address linking. See [RBAC](/chainlink-platform/rbac?parent=cre#cre) for what each role includes, and [Inviting Team Members](/chainlink-platform/inviting-team-members?parent=cre) to invite members and assign roles.

1. [Create an account](/chainlink-platform/creating-an-account?parent=cre) or sign in to [app.chain.link](https://app.chain.link).

2. Click on your account's icon in the top-right corner of the navbar and go to **Org settings** to open the **Organization** page, then navigate to the **API Keys** tab.

3. Click **Create API Key** and enter a name for the key.

4. In the **API Scope** section, expand the **CRE** section and grant the key the permissions that the CLI uses. For `platform:organization:read`, expand the **Chainlink Platform** section.

   | Name                               | Permission                                 | Description                                                                                              |
   | ---------------------------------- | ------------------------------------------ | -------------------------------------------------------------------------------------------------------- |
   | Workflow: Read                     | `cre:workflow:read`                        | View workflows.                                                                                          |
   | Workflow: Write (Private registry) | `cre:workflow:write/private_registry`      | Deploy, pause, activate, and delete workflows in the private registry.                                   |
   | Workflow artifact: Read            | `cre:workflow:artifact:read`               | Download workflow artifacts.                                                                             |
   | Workflow artifact: Write           | `cre:workflow:artifact:write`              | Upload workflow artifacts, which is required to deploy a workflow.                                       |
   | Owner address linking: Write (Cre) | `platform:owner_address:linking:write/cre` | Link and unlink workflow owner addresses, which is required to deploy workflows to the onchain registry. |
   | Organization: Read                 | `platform:organization:read`               | View organization information.                                                                           |

   See [API Keys](/chainlink-platform/api-keys?parent=cre#cre) for the full list of permissions available for CRE.

5. Click **Create API Key**, then copy the key and click **Done**. The API key is displayed only once.

This is the same key used for `CRE_API_KEY` with the CRE CLI. For the full walkthrough, see [API key authentication](/cre/reference/cli/authentication#api-key-authentication) in the CLI reference.

> **CAUTION: Keep your API key secure**
>
> Treat your API key like a password. Do not commit it to version control, share it in plain text, or feed it to an
> agent via prompt. Store it in your application's or CI/CD platform's secret management.

## Sending the API key

Send the key in the `Authorization` header using the `Apikey` scheme — **not** `Bearer`:

```http
Authorization: Apikey <CRE_API_KEY>
```

### cURL

```bash
curl -X POST \
  https://api.cre.chain.link/graphql \
  -H "Content-Type: application/json" \
  -H "Authorization: Apikey <CRE_API_KEY>" \
  -d '{
    "query": "query { getAccountDetails { memberId displayName emailAddress } }"
  }'
```

### TypeScript

```typescript
const response = await fetch("https://api.cre.chain.link/graphql", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    Authorization: `Apikey ${process.env.CRE_API_KEY}`,
  },
  body: JSON.stringify({
    query: `query { getAccountDetails { memberId displayName emailAddress } }`,
  }),
})

const result = await response.json()
```

### Go

```go
package main

import (
	"bytes"
	"encoding/json"
	"fmt"
	"net/http"
	"os"
)

func main() {
	reqBody, _ := json.Marshal(map[string]string{
		"query": `query { getAccountDetails { memberId displayName emailAddress } }`,
	})

	req, err := http.NewRequest("POST", "https://api.cre.chain.link/graphql", bytes.NewBuffer(reqBody))
	if err != nil {
		panic(err)
	}
	req.Header.Set("Content-Type", "application/json")
	req.Header.Set("Authorization", "Apikey "+os.Getenv("CRE_API_KEY"))

	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer resp.Body.Close()

	var result map[string]any
	json.NewDecoder(resp.Body).Decode(&result)
	fmt.Println(result)
}
```

## Invalid or missing credentials

If the `Authorization` header is missing, malformed, or carries an invalid or expired key, the request fails authentication. See [Errors & Rate Limits](/cre/reference/graphql-api/errors#authentication-errors) for how to detect and handle this in your client — check both the HTTP status code and the response body's `errors` array, since either can carry the failure.

## Related

- [Quickstart](/cre/reference/graphql-api/quickstart)
- [Requesting Deploy Access](/cre/guides/operations/deploy-access)
- [CLI: API key authentication](/cre/reference/cli/authentication#api-key-authentication)