Authentication
Authenticate API requests with an API key, and choose the right permission for each server.
Every request carries an API key. Create and revoke keys on the API keys page of the Cresca app. Keys start with cr_live_ and are shown only once, when you create them. Cresca stores a hash, never the key itself.
Sending the key
Send the key as a bearer token in the Authorization header:
Authorization: Bearer cr_live_xxxxxxxxxThe X-API-Key: cr_live_xxxxxxxxx header also works. Never put a key in a URL, in browser code or in a public repository; call the API from your server.
Permissions
| Permission | Can do | Use it for |
|---|---|---|
| Sending access | Send emails and batches. | Production servers. Optionally limited to one verified domain. |
| Full access | Everything: send, read and cancel emails, manage templates, add contacts. | Scripts and internal tools that need to read or manage data. |
A sending-access key that calls any other endpoint gets 401 restricted_api_key. A key limited to a domain can only send from senders on that domain; any other from address gets 403 invalid_from_address.
Authentication errors
| Status | name | Meaning |
|---|---|---|
| 401 | missing_api_key | No key in the request. |
| 403 | invalid_api_key | The key is unknown, revoked, or its account is suspended. |
| 401 | restricted_api_key | A sending-access key called an endpoint that needs full access. |
If a key leaks, revoke it on the API keys page right away; requests using it fail immediately. Then create a new key and deploy it.
Keys created before October 2026
The single key from the Profile page (used for adding contacts) keeps working and appears on the API keys page as Default key with full access.