Quickstart

Quickstart: call the Credicorp public API from Node.js

Node 18+ ships a global fetch, so you can call the Credicorp public API with zero dependencies. This quickstart lists the live products from GET /public/v1/products, parses the JSON envelope and handles the error shape — the pattern every other public-ring call reuses.

2 min read

Node 18+Global fetch, no packages
async/awaitPromise-based
data[]Every list response is enveloped

List products

With a modern Node runtime you do not need axios or node-fetch — the global fetch is enough:

const BASE = 'https://api.credicorp.co.uk/public/v1';

async function listProducts() {
  const res = await fetch(`${BASE}/products`, {
    headers: { Accept: 'application/json' },
  });
  if (!res.ok) {
    const err = await res.json();
    throw new Error(`${res.status} ${err.error?.code}: ${err.error?.message}`);
  }
  const { data } = await res.json();
  return data;
}

listProducts().then(products => {
  for (const p of products) {
    console.log(`${p.name} — up to £${p.max_amount.toLocaleString()}`);
  }
});

Handle the error envelope

Every non-2xx response uses the same envelope, so one guard clause covers all of them. The example above reads err.error.code and err.error.message; the full shape is:

{
  "error": {
    "type": "rate_limit",
    "code": "rate_limited",
    "message": "Too many requests. Retry after the window resets.",
    "request_id": "req_1c9a"
  }
}

Branch on error.code (a stable machine string), never on the human-readable message.

Environment-driven base URL

Keep the host in an environment variable so the same build runs against sandbox and production:

const BASE = process.env.CREDICORP_BASE
  || 'https://sandbox.credicorp.co.uk/public/v1';

There are no secrets for the public ring, so this is the only configuration you need.

Frequently asked questions

Which Node version do I need?

Node 18 or newer, where fetch, AbortController and structuredClone are global. On Node 16 you can polyfill with undici or node-fetch, but 18+ is recommended.

Should I add a request timeout?

Yes. Wrap the call with an AbortController and a setTimeout so a slow network never hangs your process — the same pattern shown in the resilient client recipe.

Can I use this in the browser?

The public ring sends permissive CORS headers for read endpoints, so yes — but never put partner keys in browser code. See calling the API from the browser safely.

Funding for UK limited companies

Credicorp lends to your company, not to you personally — short-term working capital with no personal guarantee. See what your business could access.