> ## Documentation Index
> Fetch the complete documentation index at: https://docs.credprotocol.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> How to authenticate with the Cred Protocol API

## Overview

The Cred Protocol API supports two authentication methods:

1. **Bearer Token Authentication** — Use an API key from your dashboard (recommended for most users)
2. **x402 Payment Authentication** — Pay per request with USDC, no account required

Most users should use Bearer token authentication. x402 payments support USDC on Base and SKALE networks. For details, see the [Authentication Guide](/guides/authentication#x402-payment-authentication).

## Getting Your API Key

<Steps>
  <Step title="Sign In">
    Log in to your account at [app.credprotocol.com](https://app.credprotocol.com).
  </Step>

  <Step title="Navigate to API Keys">
    Go to the **Dashboard** and find the **API Keys** section.
  </Step>

  <Step title="Create a Key">
    Click **Create API Key** and give it a descriptive name (e.g., "Production", "Development").
  </Step>

  <Step title="Copy Your Key">
    Copy the API key immediately. For security reasons, you won't be able to view it again.
  </Step>
</Steps>

## Using Your API Key

Include your API key in the `Authorization` header using the Bearer scheme:

<CodeGroup>
  ```bash cURL theme={null}
  curl -X GET "https://api.credprotocol.com/api/v2/score/address/vitalik.eth" \
    -H "Authorization: Bearer YOUR_API_KEY"
  ```

  ```javascript JavaScript theme={null}
  const response = await fetch('https://api.credprotocol.com/api/v2/score/address/vitalik.eth', {
    headers: {
      'Authorization': 'Bearer YOUR_API_KEY'
    }
  });
  ```

  ```python Python theme={null}
  import requests

  response = requests.get(
      'https://api.credprotocol.com/api/v2/score/address/vitalik.eth',
      headers={'Authorization': 'Bearer YOUR_API_KEY'}
  )
  ```
</CodeGroup>

## Authentication Errors

### 401 Unauthorized

If your API key is missing, invalid, or expired, you'll receive a `401` error:

```json theme={null}
{
  "detail": "Invalid or missing API key"
}
```

**Common causes:**

* Missing `Authorization` header
* Typo in the API key
* Using `API_KEY` instead of `Bearer API_KEY`
* Revoked or deleted API key

### 403 Forbidden

If your API key doesn't have permission for the requested resource:

```json theme={null}
{
  "detail": "Insufficient permissions"
}
```

## Best Practices

<AccordionGroup>
  <Accordion title="Never expose your API key in client-side code">
    API keys should be kept on your server. Never include them in frontend JavaScript, mobile apps, or public repositories.

    ```javascript theme={null}
    // ❌ Bad - API key exposed in client-side code
    fetch('https://api.credprotocol.com/api/v2/score/address/vitalik.eth', {
      headers: { 'Authorization': 'Bearer sk_live_abc123' }
    });

    // ✅ Good - Call your own backend
    fetch('/api/credit-score?address=vitalik.eth');
    ```
  </Accordion>

  <Accordion title="Use environment variables">
    Store your API key in environment variables, not in code:

    ```bash theme={null}
    # .env
    CRED_API_KEY=your_api_key_here
    ```

    ```javascript theme={null}
    // server.js
    const apiKey = process.env.CRED_API_KEY;
    ```
  </Accordion>

  <Accordion title="Use different keys for different environments">
    Create separate API keys for development, staging, and production. This makes it easy to rotate keys without affecting other environments.
  </Accordion>

  <Accordion title="Rotate keys regularly">
    Periodically rotate your API keys, especially if you suspect they may have been compromised.
  </Accordion>

  <Accordion title="Monitor your usage">
    Regularly check your API usage in the Dashboard to detect unusual activity.
  </Accordion>
</AccordionGroup>

## Key Management

### Viewing Your Keys

You can view all your API keys (but not the key values) in the Dashboard. Each key shows:

* **Name**: The name you gave the key
* **Created**: When the key was created
* **Last Used**: The most recent API request using this key
* **Status**: Active or revoked

### Revoking a Key

If you need to revoke an API key:

1. Go to the **API Keys** section in your Dashboard
2. Find the key you want to revoke
3. Click **Revoke**

<Warning>
  Revoking a key is immediate and permanent. Any applications using that key will stop working.
</Warning>

## Testing Authentication

Use this endpoint to verify your API key is working:

```bash theme={null}
curl -X GET "https://api.credprotocol.com/users/me" \
  -H "Authorization: Bearer YOUR_API_KEY"
```

A successful response returns your user profile:

```json theme={null}
{
  "id": "uuid",
  "email": "you@example.com",
  "is_active": true,
  "is_verified": true
}
```