# Authentication
Source: https://docs.chain.link/cre/reference/graphql-api/authentication
Last Updated: 2026-08-31

> For the complete documentation index, see [llms.txt](/llms.txt).

Every request to the CRE GraphQL API must include an `Authorization` header carrying a CRE API key.

> **NOTE: Deploy access required**
>
> Creating an API key requires your account to have deploy access approval. Run `cre account access` with the CRE CLI to
> check your status or submit a request. See [Requesting Deploy Access](/cre/account/deploy-access).

## Creating an API key

CRE API keys are created from the CRE platform UI, not from the GraphQL API itself.

1. Log in to the <a href="https://app.chain.link/cre/discover" target="_blank" rel="noopener noreferrer">CRE platform</a>
2. Navigate to the **Organization** page
3. Select the **APIs** tab
4. Click **+ Organization API**
5. Give your key a name and confirm

This is the same key used for `CRE_API_KEY` with the CRE CLI. For the full walkthrough, see [API key authentication](/cre/reference/cli/authentication#api-key-authentication) in the CLI reference.

> **CAUTION: Keep your API key secure**
>
> Treat your API key like a password. Do not commit it to version control or share it in plain text. Store it in your
> application's or CI/CD platform's secret management.

## Sending the API key

Send the key in the `Authorization` header using the `Apikey` scheme — **not** `Bearer`:

```http
Authorization: Apikey <CRE_API_KEY>
```

### cURL

```bash
curl -X POST \
  https://api.cre.chain.link/graphql \
  -H "Content-Type: application/json" \
  -H "Authorization: Apikey <CRE_API_KEY>" \
  -d '{
    "query": "query { getAccountDetails { memberId displayName emailAddress } }"
  }'
```

### TypeScript

```typescript
const response = await fetch("https://api.cre.chain.link/graphql", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    Authorization: `Apikey ${process.env.CRE_API_KEY}`,
  },
  body: JSON.stringify({
    query: `query { getAccountDetails { memberId displayName emailAddress } }`,
  }),
})

const result = await response.json()
```

### Go

```go
package main

import (
	"bytes"
	"encoding/json"
	"fmt"
	"net/http"
	"os"
)

func main() {
	reqBody, _ := json.Marshal(map[string]string{
		"query": `query { getAccountDetails { memberId displayName emailAddress } }`,
	})

	req, err := http.NewRequest("POST", "https://api.cre.chain.link/graphql", bytes.NewBuffer(reqBody))
	if err != nil {
		panic(err)
	}
	req.Header.Set("Content-Type", "application/json")
	req.Header.Set("Authorization", "Apikey "+os.Getenv("CRE_API_KEY"))

	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer resp.Body.Close()

	var result map[string]any
	json.NewDecoder(resp.Body).Decode(&result)
	fmt.Println(result)
}
```

## Invalid or missing credentials

If the `Authorization` header is missing, malformed, or carries an invalid or expired key, the request fails authentication. See [Errors & Rate Limits](/cre/reference/graphql-api/errors#authentication-errors) for how to detect and handle this in your client — check both the HTTP status code and the response body's `errors` array, since either can carry the failure.

## Related

- [Quickstart](/cre/reference/graphql-api/quickstart)
- [Requesting Deploy Access](/cre/account/deploy-access)
- [CLI: API key authentication](/cre/reference/cli/authentication#api-key-authentication)