Authentication
Send your client key and client secret with every request. There is no token exchange, refresh flow, or session.
CLIENT-KEY: YOUR_CLIENT_KEY CLIENT-SECRET: YOUR_CLIENT_SECRET Accept: application/json
Getting access
Cru issues credentials for your organisation with specific scopes. Credentials can also be restricted to particular markets and IP addresses. Request the API base URL with your credentials.
Verify your credentials
Call GET /ping to see the account, label, scopes, and expiry associated with the credential. It does not expose trading data.
Read credentials from environment variables. Do not embed them in frontend code, public repositories, or URLs. Copied examples use environment variable names, never the credentials entered in the console.
Explorer credentials
Credentials entered here are held in page memory only. Reloading the page or selecting Clear credentials removes them, and they are redacted from anything the console prints back.
HTTPS is required
Plain HTTP is rejected with A007. Use a trusted certificate, including in local development.
The reference states that secrets are displayed only at issue and stored as hashes. Contact Cru to suspend and replace a lost credential.