Quickstart: your first Credicorp public API

Q: What happens if I hit the rate limit?

You receive a 429 with code: rate_limited and a RateLimit-Reset header telling you when the window resets. See handling rate limits for a back-off recipe.

2 min read

0 keysPublic ring needs no auth

60/minDefault public rate limit

JSONEvery response is application/json

Make the call

The public ring lives under /public/v1 on the API host. It is read-only for product and reference data and accepts unauthenticated requests, so a plain curl is enough to get a real response:

curl -s https://api.credicorp.co.uk/public/v1/products \
  -H 'Accept: application/json'

You will get back a JSON object with a data array of products. Each product carries an id, a display name, the type (for example flex or onetime) and headline pricing fields you can render straight into a comparison table.

Read the response

A trimmed response looks like this:

{
  "data": [
    {
      "id": "flex-business",
      "name": "Credicorp Flex",
      "type": "flex",
      "min_amount": 1000,
      "max_amount": 150000,
      "representative_apr": 49.9,
      "currency": "GBP"
    }
  ],
  "request_id": "req_7bd1f0a2"
}

The request_id is echoed on every response and in the X-Request-Id header — quote it if you ever open a support ticket. Figures are illustrative representative rates; a firm quote comes from the quote endpoint.

Point at the sandbox first

Everything you build should be developed against the sandbox host, which mirrors the public ring with deterministic test data and looser limits:

curl -s https://sandbox.credicorp.co.uk/public/v1/products -H 'Accept: application/json'

Swapping the base host is the only change needed to move between sandbox and production for public-ring calls — there are no keys to rotate.

Frequently asked questions

Do I need an API key to call /public/v1/products?

No. The public ring is deliberately unauthenticated so integrators can read product and reference data without onboarding. Keys and OAuth2 only apply to the /partner/v1 ring, which handles applications, decisions and payments.

What happens if I hit the rate limit?

You receive a 429 with code: rate_limited and a RateLimit-Reset header telling you when the window resets. See handling rate limits for a back-off recipe.

Is the product data cacheable?

Yes. Product and pricing reference data changes infrequently; respect the Cache-Control header on the response and you can safely cache the product list for the max-age it advertises.