Skip to main content
All Partner API endpoints require authentication with your partner API key.

​
API key header

Partner API keys start with cr3d_. Send the key in the x-api-key header:
The x-api-key header is the only place the API accepts your key. Never send it as Authorization: Bearer. All requests with a body must also include:

​
Response envelope

Every successful response is wrapped in a standard envelope:
Error responses return the appropriate HTTP status code with details in the body:

​
Managing keys

Treat your API key like a password. Keep it on your server: never ship it in an app, expose it in client-side code or commit it to source control.
API keys can be rotated at any time from your dashboard. Rotating a key immediately invalidates the previous one.