Authentication and keys
Every call sends a key in the Authorization header:
Authorization: Bearer crp_test_...Never put a key in a URL, a log or client-side code.
| Mode | Host | Keys |
|---|---|---|
| Live | https://api.creatorain.com/v1 |
crp_live_..., crp_rk_live_... |
| Sandbox | https://sandbox.api.creatorain.com/v1 |
crp_test_..., crp_rk_test_... |
Key kinds
Section titled “Key kinds”crp_live_andcrp_test_: standard keys, live and sandbox.crp_rk_live_andcrp_rk_test_: restricted keys, same modes.crp_obs_: an onboarding session secret. It polls one session and nothing else. See Agent quick start.
A test key on the live host is 401 test_key_on_live. A live key on the sandbox is 401 live_key_on_sandbox.
A key is shown once, when it is made. CreatoRain stores only a hash of it. A key acts for one workspace.
Scopes
Section titled “Scopes”| Scope | Lets the key |
|---|---|
read |
Read the account, locations, visits, videos and bill preview. |
samples:read |
Read creator samples. Not live yet |
locations:write |
Add stores. |
balance:write |
Top up, refund, lower limits. Not live yet |
creators:read |
Creator data. Not live yet |
webhooks:write |
Manage webhook endpoints. Not live yet |
A call without the scope it needs is 403 scope_missing.
IP allowlist
Section titled “IP allowlist”A key may carry an IP allowlist. A request from another address is 403 forbidden_ip.
Failed authentication
Section titled “Failed authentication”Twenty failed authentications (missing or unknown key) from one address within a minute block that address for 15 minutes.
Live keys
Section titled “Live keys”A live key needs one paid top-up on the account first. See Going live.
Leaked keys
Section titled “Leaked keys”Live key prefixes will be registered with GitHub secret scanning, so a leaked key is revoked on report. Not live yet