Authentication

Account API keys

Developer API requests use Account API keys from Developer Console. Keys start with cr_sk_ and authenticate only the public /v1/* API.

Authorization: Bearer cr_sk_your_key_here

If your platform cannot set a custom Authorization header, pass the key as a creao-api-key query parameter instead. The header always takes precedence when both are present.

POST https://developer.creao.ai/v1/runs?creao-api-key=cr_sk_your_key_here

Prefer the Authorization header whenever possible. A key passed via query parameter can be captured in infrastructure access logs (e.g. CDN/load-balancer request logs), browser history, and referrer headers — sinks the header form avoids. Only use the query parameter when your platform genuinely cannot set a custom header, and rotate keys used this way more frequently.

This page covers Developer Platform Account API keys. App-scoped API Trigger keys are created from an agent detail page in agent.creao.ai, start with capi_, and authenticate the app-scoped agent.creao.ai/api/v1/apps/{appId}/runs route. See API Paths for the comparison.

Account API keys are server-side secrets. Do not put them in browser frontend code, mobile apps, public repositories, client logs, or analytics events.

Create a key

Open Developer Console

Go to developer.creao.ai with the CREAO account that owns the agents you want to run.

Create an Account API key

Open API Keys, create a key, and store it immediately. The full key is shown only once.

Copy an agent ID

Start a personal-agent creation run with POST /v1/agents and poll it for the new agent_id, or open Agents and copy the agent_id for an active personal agent. Developer Platform runs agents you own in CREAO.

Scope

Account API keys can create, edit, and run personal agents owned by the same CREAO account, manage agent memory and skill files, manage personal workspace files, create personal workspaces, manage account secrets, and install or enable account-level Agent Brain skills. They cannot create or edit team agents, upload agent skill files, manage schedules, publish to Agent Store, access Console session APIs, or authenticate internal CREAO routes. If a key is missing, malformed, revoked, or unknown, the API returns:

{ "error": "AUTHENTICATION_REQUIRED" }

Backend example

Node.js

const response = await fetch("https://developer.creao.ai/v1/runs", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.CREAO_API_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    agent_id: "00000000-0000-4000-8000-000000000000",
    input: { query: "Summarize this customer feedback export" },
  }),
});

const run = await response.json();

Key rotation

Create a new key, update your backend secret store, deploy the new value, then revoke the old key in Developer Console. Revoked keys cannot be restored.

Get Started

Agents

Agent Memory

Agent Files

Runs

Models

Workspaces

Workspace Files

Secrets

Skills

Concepts

Account API keys

Create a key

Scope

Backend example

Key rotation

​Account API keys

​Create a key

​Scope

​Backend example

​Key rotation

Account API keys

Create a key

Scope

Backend example

Key rotation