Quickstart

Quickstart: call the Credit Corp public API from Node.js

Node 18+ ships a global fetch, so you can call the Credit Corp public API with zero dependencies. This quickstart lists the live products from GET /public/v1/products, parses the JSON envelope and handles the error shape — the pattern every other public-ring call reuses.

2 min read

Node 18+Global fetch, no packages
async/awaitPromise-based
data[]Every list response is enveloped

List products

With a modern Node runtime you do not need axios or node-fetch — the global fetch is enough:

const BASE = 'https://api.credicorp.co.uk/public/v1';

async function listProducts() {
  const res = await fetch(`${BASE}/products`, {
    headers: { Accept: 'application/json' },
  });
  if (!res.ok) {
    const err = await res.json();
    throw new Error(`${res.status} ${err.error?.code}: ${err.error?.message}`);
  }
  const { data } = await res.json();
  return data;
}

listProducts().then(products => {
  for (const p of products) {
    console.log(`${p.name} — up to £${p.max_amount.toLocaleString()}`);
  }
});

Handle the error envelope

Every non-2xx response uses the same envelope, so one guard clause covers all of them. The example above reads err.error.code and err.error.message; the full shape is:

{
  "error": {
    "type": "rate_limit",
    "code": "rate_limited",
    "message": "Too many requests. Retry after the window resets.",
    "request_id": "req_1c9a"
  }
}

Branch on error.code (a stable machine string), never on the human-readable message.

Environment-driven base URL

Keep the host in an environment variable so the same build runs against sandbox and production:

const BASE = process.env.CREDICORP_BASE
  || 'https://sandbox.credicorp.co.uk/public/v1';

There are no secrets for the public ring, so this is the only configuration you need.

Frequently asked questions

Which Node version do I need?

Node 18 or newer, where fetch, AbortController and structuredClone are global. On Node 16 you can polyfill with undici or node-fetch, but 18+ is recommended.

Should I add a request timeout?

Yes. Wrap the call with an AbortController and a setTimeout so a slow network never hangs your process — the same pattern shown in the resilient client recipe.

Can I use this in the browser?

The public ring sends permissive CORS headers for read endpoints, so yes — but never put partner keys in browser code. See calling the API from the browser safely.

Funding for UK limited companies

Credit Corp lends to your company, not to you personally — short-term working capital with no personal guarantee. See what your business could access.