Cresc

    API Key

    An API Key is an authentication method used to invoke the Cresc API within CI/CD pipelines or automated scripts. Compared to standard username/password logins, API Keys are much more secure and easier to manage.

    Use Cases

    • Continuous Integration/Deployment (CI/CD): Automate OTA update publishing via GitHub Actions, GitLab CI, Jenkins, etc.
    • Automation Scripts: Write scripts to manage apps, versions, or native packages in bulk.
    • Third-Party Integrations: Wrap Cresc's workflows into external developer tools.

    Creating an API Key

    1. Log into the Cresc Dashboard
    2. Click on "API Key" in the left sidebar menu.
    3. Click the "Create API Key" button.
    4. Enter a name for the API Key (e.g., CI/CD Pipeline).
    5. Select the required permissions.
    6. (Optional) Set an expiration date.
    7. Click Create, and copy the secret API Key immediately.
    Warning

    The API Key string is only displayed once upon creation. You will not be able to view it again. Be sure to save it safely immediately!

    Permissions

    PermissionDescription
    ReadView app details, version info, and native package details
    WriteCreate/Update apps, publish new versions, upload native packages
    DeleteDelete apps, versions, and packages
    Info

    You must select at least one permission when creating a API Key. Applying the principle of least privilege is a best practice.

    Using API Key with API

    When calling the Cresc API, supply the API Key via the x-api-token HTTP header:

    curl -X GET "https://api.cresc.dev/app/list" \
  -H "x-api-token: YOUR_API_TOKEN"
    Info

    The header x-api-token and the environment variable CRESC_API_TOKEN are wire-level names kept unchanged for compatibility with existing integrations. The console and the docs call it an API Key — they are the same thing.

    Using in the CLI

    If you're using the react-native-update-cli tool (v2.7.0+), you can pass the API Key via environment variables:

    export CRESC_API_TOKEN=your_api_token_here
cresc bundle --platform android

    Using in CI/CD Environments

    Here is an example configuring a GitHub Action:

    # .github/workflows/publish.yml
name: Publish Hot Update

on:
  push:
    branches: [main]

jobs:
  publish:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      
      - name: Setup Node.js
        uses: actions/setup-node@v6
          
      - name: Install dependencies
        run: npm install && npm i -g react-native-update-cli
        
      - name: Publish update
        env:
          CRESC_API_TOKEN: ${{ secrets.CRESC_API_TOKEN }}
        run: cresc bundle --platform android
    Tip

    In CI/CD pipelines, always store your API Key securely using the platform's Secret Manager (e.g., GitHub Secrets) rather than hardcoding them in your configuration scripts.

    Managing API Key

    Viewing API Key List

    On the "API Key" page, you can view all created API Key, including:

    • API Key Name
    • Permissions
    • Expiration Time
    • Last Used Time
    • Status (Active/Expired/Revoked)

    Revoking a API Key

    If a API Key is leaked or no longer needed, you can revoke it at any time:

    1. Identify the API Key in the table list.
    2. Click the "Revoke" button.
    3. Confirm revocation.
    Warning

    Revocations take effect immediately. Any API requests made using a revoked API Key will be instantly rejected. Ensure you update any dependent CI/CD setups before revoking.

    Security Practices

    1. Principle of Least Privilege: Only grant the exact permissions required.
    2. Set Expirations: Try to use short-lived API Key or configure expirations for temporary integration projects.
    3. Periodic Rotation: Routinely revoke old API Key and cycle in new API Key for long-running workflows.
    4. Secure Storage: Never commit API Key directly to your repository source code.
    5. Monitor Usage: Check the 'Last Used Time' and delete idle API Key routinely.

    Limits

    • Each user can create a maximum of 10 API Keys.
    • To create additional API Key, you must first revoke existing unused API Key.