Authentication

The CRED External API v2 authenticates every request with a scoped bearer token. This page is the standalone Authorization reference; each endpoint page also shows the token requirement inline.

Get a token

Mint a token in-platform: Settings → API access → Create token. Choose the least-privilege scopes the integration needs and (optionally) an expiry. Tokens look like:

cred_uapi_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Copy it once at creation — CRED stores only a hash and cannot show it again.

Send the token

Pass it as a bearer token on every request:

Authorization: Bearer cred_uapi_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Scopes

Each token carries one or more <action>:<resource> scopes. An endpoint declares the scope it requires (shown on its page); a call whose token lacks that scope returns 403.

Resources are enumerated per surface — e.g. match:companies, enrich:contacts, write:opportunities, read:analytics, action:assistant.

Token lifecycle

• Expiry — user tokens default to a 1-year TTL and can be set shorter. Expired tokens return 401.
• Machine tokens — non-expiring tokens for server-to-server use; create these explicitly.
• Revocation — revoke any token from Settings → API access. Revoked tokens return 401 immediately.

Workspace enablement

The whole External API v2 surface is gated per workspace by the api_external_v2 flag. If it is off for your workspace, every call returns 403 regardless of token scope — contact your CRED admin to enable it.

Response headers

Every response carries:

• X-Request-Id — include this when reporting an issue so we can trace the call.
• X-RateLimit-Limit / X-RateLimit-Remaining / X-RateLimit-Reset — your current rate-limit budget.

Error reference