Get started

Authentication

A call that takes a body needs a key. A call you could open as a link does not.

1. 1

   Get a sandbox key

   No account, no card.

   curlNodePython

   curl -s -X POST https://app.creditcresttechnologies.com.au/v1/keys/sandbox

   const res = await fetch('https://app.creditcresttechnologies.com.au/v1/keys/sandbox', {
     method: 'POST',
   });
   console.log(await res.json());

   import json, urllib.error, urllib.request
   
   req = urllib.request.Request(
       "https://app.creditcresttechnologies.com.au/v1/keys/sandbox",
       method="POST",
   )
   try:
       with urllib.request.urlopen(req) as res:
           print(json.load(res))
   except urllib.error.HTTPError as e:
       print(json.load(e))

   {
     "key": "cc_test_eyJ2Ijox…",
     "id": "8iinormn",
     "mode": "test",
     "expires": "2026-12-10"
   }

2. 2

   Send it

   In the Authorization header, on every call. Keep it in an environment variable, never in source code.

   curlNodePython

   curl -s -X POST https://app.creditcresttechnologies.com.au/v1/statement \
     -H "authorization: Bearer $CREDITCREST_KEY" \
     -H 'content-type: text/csv' \
     --data-binary @statement.csv

   import { readFile } from 'node:fs/promises';
   
   const res = await fetch('https://app.creditcresttechnologies.com.au/v1/statement', {
     method: 'POST',
     headers: {
       authorization: `Bearer ${process.env.CREDITCREST_KEY}`,
       'content-type': 'text/csv',
     },
     body: await readFile('statement.csv'),
   });
   console.log(await res.json());

   import json, os, urllib.error, urllib.request
   
   req = urllib.request.Request(
       "https://app.creditcresttechnologies.com.au/v1/statement",
       data=open("statement.csv", "rb").read(),
       headers={
           "Authorization": "Bearer " + os.environ["CREDITCREST_KEY"],
           "Content-Type": "text/csv",
       },
       method="POST",
   )
   try:
       with urllib.request.urlopen(req) as res:
           print(json.load(res))
   except urllib.error.HTTPError as e:
       print(json.load(e))

Sandbox and live

The prefix says which a key is, so a key pasted in the wrong place is plain at a glance and to secret scanners.

Limits

Per key, per minute: 600 calls on a live key and 60 on a sandbox key. Sandbox keys themselves: 5 a minute from one network address. Over a limit, the answer is 429 rate_limited with Retry-After.

When a key is refused

What an answer says

What is recorded

Each call made with a key is counted — the key’s id, the endpoint, the status and the time — so it can be billed. A sandbox key’s calls also keep the error code of a call that failed, and are deleted after 35 days. Nothing you send is kept or logged. GET /v1/usage shows your month and what it comes to.

{reason}: why it is issued, at most 300 characters

{rows: [{id, lender, mode, item, kid, status, of, amount, at}]}