Skip to main content
The Partner API v1 is a read surface. Every request authenticates with a single credential:
  • An API key, presented as a Bearer token over TLS. It identifies your partner account and carries your granted scopes.
There is no request body to sign on a read, so reads are not signed; the Bearer key over TLS is the only credential you need.

​
API keys

Keys are issued by CrewPass and look like: Present the key as a Bearer token (preferred) or in the X-Partner-API-Key header:
Your granted scopes are derived from your CrewPass plan, so you do not manage a separate API permission set. Call GET /api/v2/partners/me to see your identity and full granted-scope list. It is the first call any partner makes.
Keep your API key server-side. Never embed it in a browser or mobile app. Public read-only widget keys (cppk_*) are a separate surface and are not accepted here.

​
Calling a read endpoint

Every v1 read takes the same Bearer header and nothing else:
A missing or invalid key returns invalid_api_key. Calls are still rate-limited per partner (see Rate limits) and recorded in your audit log.
Outbound webhook deliveries are signed by CrewPass so you can verify they are genuine; see Webhooks for how to verify a delivery signature.