Developers

Build trust into any application

One deterministic trust ledger behind a documented REST API: read portable reputation, report real outcomes, verify credentials offline, and give AI agents a trust check. Everything lives on the developer platform at api.credda.io.

Open the developer platform Read the docs

REST API

Documented, versioned, key-authenticated

Score reads, event ingestion with idempotency keys, batch lookups, cursor pagination, disputes and usage metering: all under /api/v1, all in the OpenAPI spec.

Documentation

Guides and concepts: authentication, event ingestion, scoring, credentials and webhooks.

api.credda.io/docs

Interactive reference

Every endpoint, browsable and callable, generated from the same spec the server enforces.

api.credda.io/reference

OpenAPI 3.1 spec

The machine-readable contract. A test asserts every route is documented, so it cannot drift.

api.credda.io/openapi.json

Developer console

Self-serve API keys, usage and webhooks. Sign in with the same Credda account you use here.

api.credda.io/console

Official packages

Install and go

Three packages are published to npm today. Each is a thin, typed client over the same API; zero scoring logic ships in a package.

@credda/js

npm

TypeScript SDK

Typed client for the whole API: score reads, event reporting, share tokens, webhook signature verification, and offline credential verification. A headless entry point keeps React out of server bundles.

$ npm install @credda/js

@credda/cli

npm

Command line

Look up scores, export trust bundles, and offline-verify a credential from your terminal, with CI-friendly exit codes included. Manage webhooks and receive test deliveries locally with credda listen.

$ npm install -g @credda/cli

@credda/mcp-server

npm

MCP server for AI agents

A Model Context Protocol server so any MCP-aware agent (Claude Desktop, Claude Code, custom runtimes) can check a counterparty’s trust, or present its own credential, mid-reasoning, without a human in the loop.

$ npx -y @credda/mcp-server

Python and Go SDKs exist in the open monorepo with the same surface and wire-compatible webhook verification. They are not yet published to PyPI or pkg.go.dev, so for now they are available in the repo only.

Platform capabilities

Trust primitives, not just endpoints

Webhooks, HMAC-signed

Subscribe to score, dispute, monitor, threshold-policy, import and quota events instead of polling; the live catalog is served at /api/v1/webhooks/events. Every delivery is HMAC-SHA256 signed with replay protection, retried with backoff, and replayable from a per-attempt delivery log.

Verifiable credentials

Scores are issued as W3C Verifiable Credentials signed by did:web:api.credda.io, with StatusList2021 revocation. Anyone can verify one offline: no API call, no phone-home.

Embeddable badge widget

A one-line script tag from api.credda.io renders a live, Shadow-DOM-isolated trust badge on any page. Share tokens are rotatable, and disclosure scopes control how much a badge reveals.

Deterministic by contract

The scoring model itself is a public endpoint: weights, thresholds and the unproven anchor. There is deliberately no AI-verdict endpoint. The API explains evidence, it never passes judgment on a person.

Get a key and make your first call

Open the console See what people build