Accredible
BUSINESS · PEOPLE
Certificates, badges, groups, and designs issued from the account they connected.
Connecting Accredible in practice
Accredible authenticates with a non-standard header value — `Authorization: Token token=YOUR_API_KEY` rather than a bearer token — and sandbox lives on a different hostname, sandbox.api.accredible.com, with its own key, so nothing about a working test integration carries over to production except the code.
Scopes that draw scrutiny
API Key (Accredible’s own term)There is no scope mechanism: one key is what the integration needs to authenticate and issue credentials, and Accredible’s guidance is to mint a separate key per integration rather than to narrow a key’s permissions.
Worth knowing
- The credential-issuing API is versioned in the path (https://api.accredible.com/v1) with a parallel sandbox host, so the base URL is environment-specific and easy to leave pointed at sandbox.
- The published reference at docs.api.accredible.com renders through a JavaScript shell, so the endpoint list cannot be read by a crawler or an agent without a browser.
- Accredible does not publish a rate limit on the developer documentation, so throughput has to be discovered against a live key rather than designed for.
Checked against Accredible API documentation (2026-09-29), Finding your integration API key (2026-09-29)
What an agent can do
Each action is granted on its own. An agent allowed to read is not thereby allowed to write, and the scope beside each row is what the acting user must have connected for it to run at all.
Often connected alongside
Put Accredible behind one governed endpoint.
Same permissions, same audit trail, whatever else you connect next.