CREHQ · Authentication Profile

CREHQ Authentication

Authentication

CREHQ declares 3 security scheme(s) across its OpenAPI definitions.

CompanyCommercial Real EstateLocation IntelligenceLocation DataDatasetsFranchise DataSite SelectionMCPData Licensing
Methods: Schemes: 3 OAuth flows: API key in:

Security Schemes

bearerApiKey http
scheme: bearer
xApiKey apiKey
· in: header ()
mcpOAuth oauth2

Source

Authentication Profile

crehq-com-authentication.yml Raw ↑ 
generated: '2026-11-04'
method: searched
source: https://crehq.com/developers/
docs: https://crehq.com/developers/
schemes:
- name: bearerApiKey
  type: http
  scheme: bearer
  description: 'Every request must include a CREHQ API key, e.g. "Authorization: Bearer crehq_live_your_key_here".'
- name: xApiKey
  type: apiKey
  in: header
  header: X-API-Key
  description: '"X-API-Key header also works" (developer hub). Sandbox /selfserve/ examples use X-API-Key.'
- name: mcpOAuth
  type: oauth2
  description: The hosted MCP connector at https://mcp.crehq.com/mcp uses an OAuth hosted connector flow; the user authorizes the connector and pastes their CREHQ sandbox, paid or enterprise API key. No scopes are published.
key_types:
- prefix: crehq_live_
  note: Prefix shown in the developer hub example key; no test-key prefix is documented.
key_issuance: Free sandbox keys are delivered by email only (never returned in the HTTP response); signup is browser-only behind Turnstile (https://crehq.com/developers/sandbox/).
access_model: Access follows the key; a sandbox key or research membership does not grant access to every production route.

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this
  • find_securityBrowse and filter every security artifact in the catalog.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This security artifact 
curl "https://apis.io/api/v1/security/crehq-com-authentication"
All security posture 
curl "https://apis.io/api/v1/security?limit=25"

Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.