Authentication

Every request to the CRE GraphQL API must include an Authorization header carrying a CRE API key.

Creating an API key

CRE API keys are created from the Chainlink Platform UI, not from the GraphQL API itself.

You must be the organization Owner or have the CRE Admin role, to create an API key with these permissions. See RBAC for how roles work.

1. Sign in to the Chainlink Platform, click your account icon in the top-right corner of the navbar, and click "Org settings" in the dropdown to open the Organization page, then open the API Keys tab.

2. Click Create API Key and enter a name for the key.

3. In the API Scope section, expand the CRE accordion and set its preset to All. This grants the following permissions. See API Keys for the full list of permissions available for CRE.

   • cre:workflow:read
   • cre:workflow:artifact:read
   • cre:workflow:artifact:write
   • cre:workflow:write/private_registry
   • platform:owner_address:linking:write/cre

4. Click Create API Key, then copy the key and click Done. The API key is displayed only once.

This is the same key used for CRE_API_KEY with the CRE CLI. For the full walkthrough, see API key authentication in the CLI reference.

Sending the API key

Send the key in the Authorization header using the Apikey scheme — not Bearer:

Authorization: Apikey <CRE_API_KEY>

cURL

curl -X POST \
  https://api.cre.chain.link/graphql \
  -H "Content-Type: application/json" \
  -H "Authorization: Apikey <CRE_API_KEY>" \
  -d '{
    "query": "query { getAccountDetails { memberId displayName emailAddress } }"
  }'

TypeScript

const response = await fetch("https://api.cre.chain.link/graphql", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    Authorization: `Apikey ${process.env.CRE_API_KEY}`,
  },
  body: JSON.stringify({
    query: `query { getAccountDetails { memberId displayName emailAddress } }`,
  }),
})

const result = await response.json()

Go

package main

import (
	"bytes"
	"encoding/json"
	"fmt"
	"net/http"
	"os"
)

func main() {
	reqBody, _ := json.Marshal(map[string]string{
		"query": `query { getAccountDetails { memberId displayName emailAddress } }`,
	})

	req, err := http.NewRequest("POST", "https://api.cre.chain.link/graphql", bytes.NewBuffer(reqBody))
	if err != nil {
		panic(err)
	}
	req.Header.Set("Content-Type", "application/json")
	req.Header.Set("Authorization", "Apikey "+os.Getenv("CRE_API_KEY"))

	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer resp.Body.Close()

	var result map[string]any
	json.NewDecoder(resp.Body).Decode(&result)
	fmt.Println(result)
}

Invalid or missing credentials

If the Authorization header is missing, malformed, or carries an invalid or expired key, the request fails authentication. See Errors & Rate Limits for how to detect and handle this in your client — check both the HTTP status code and the response body's errors array, since either can carry the failure.

Related

• Quickstart
• Requesting Deploy Access
• CLI: API key authentication