Developers
Authentication
The manufacturer API uses API keys sent in the X-Api-Key header. Each key belongs to one company, carries only the scopes you choose, and can be revoked at any time.
Create a key
- Sign in to the company portal as an owner or admin. Only owners and admins can manage API keys, and your company must be approved by CredChek.
- Go to Settings → API keys and select Create API key.
- Enter a Name, pick a preset under Start from a preset or tick individual Scopes, choose when it Expires, then select Create key.
- Copy the key from Copy your new API key. This is the only time you’ll see the full key.
Send the key
curl https://api.credchek.com/v1/products -H "X-Api-Key: $CREDCHECK_API_KEY"Server-side only
Use keys from your own servers only. Never put a key in a website, mobile app, public repository or log. Store it in a secrets manager. If a key may have leaked, revoke it in Settings → API keys (it stops working at once) and create a new one.
Sandbox and production
| Environment | Base URL | Key prefix |
|---|---|---|
| Production | https://api.credchek.com | cc_live_ |
| Sandbox | https://api.sandbox.credchek.com | cc_test_ |
The sandbox has its own accounts and data. Create sandbox keys in the sandbox portal ([[SANDBOX PORTAL URL]]). A key only works in its own environment: a cc_test_ key sent to production (or the reverse) is rejected with 401 wrong_environment.
Scopes
Endpoints are closed to API keys unless they opt in to a scope. Team, billing, settings, API key management and sign-in endpoints can never be called with a key. The API reference shows the scope each endpoint needs.
| Scope | Allows |
|---|---|
products:read | Read products, batches and batch details |
products:write | Create, update and delete products and add batches |
recalls:write | Start batch recalls |
codes:read | Read code metadata and generation jobs (never plaintext serials) |
codes:write | Generate and import codes, change code status |
codes:export | Download encrypted code deliverables (plaintext serials) |
analytics:read | Read verification analytics |
alerts:read | Read fraud alerts |
alerts:write | Update fraud alert status |
reports:read | Read consumer reports |
reports:write | Update consumer report status and respond |
webhooks:manage | Manage webhook endpoints and deliveries |
Presets in the portal
- Read-only reporting:
products:read,codes:read,analytics:read - ERP / product sync:
products:read,products:write - Packaging line (codes):
products:read,codes:read,codes:write,codes:export - Alerts & webhooks:
alerts:read,reports:read,webhooks:manage
codes:export returns plaintext serials
Only give it to the system that prints your codes.
Keys never exceed their creator’s permissions
A key acts on behalf of the person who created it. Every request is checked against both the key’s scopes and that person’s current role in the company. If their role changes or they lose access, the key loses those permissions too.
Authentication errors
| Status | Code | Meaning |
|---|---|---|
| 401 | invalid_api_key | The key is missing, malformed or unknown. |
| 401 | wrong_environment | A test key was sent to production, or a live key to the sandbox. |
| 401 | api_key_revoked | The key has been revoked. |
| 401 | api_key_expired | The key has passed its expiry date. |
| 403 | insufficient_scope | The key doesn’t have the scope this endpoint needs. |
| 403 | api_key_not_allowed | This endpoint is not available to API keys. |