Complete Criminal Checks Authentication: Methods & Security (2026)

Authentication overview

Complete Criminal Checks utilizes API keys as its primary method for authenticating programmatic access to its background check services. This approach involves generating a unique, secret token that identifies and authorizes an application or user when making requests to the Complete Criminal Checks API. The API key serves as a credential to confirm the identity of the requesting entity and to ensure it has the necessary permissions to access specific resources or perform particular actions Complete Criminal Checks homepage.

API key authentication is widely adopted for its simplicity and effectiveness in securing API endpoints. When a request is made to the Complete Criminal Checks API, the provided API key is validated against the system's stored keys. If the key is valid and active, the request is processed; otherwise, access is denied. This mechanism protects sensitive background check data by preventing unauthorized access and ensuring data integrity.

Effective management of API keys is crucial for maintaining security. This includes safeguarding keys from unauthorized disclosure, regularly rotating them, and adhering to the principle of least privilege when assigning access rights associated with each key. The use of HTTPS/TLS encryption is also fundamental to protect API keys and data in transit, preventing eavesdropping and tampering during communication between client applications and the Complete Criminal Checks servers Mozilla's TLS overview.

Supported authentication methods

Complete Criminal Checks primarily supports API key authentication for its programmatic interfaces. This method is designed to provide a straightforward yet secure way for developers to integrate background check functionalities into their applications.

API Key Authentication

API keys are unique alphanumeric strings generated within the Complete Criminal Checks user dashboard. These keys act as a token that applications include with each API request to verify their identity and authorization. When a request is received, the API gateway validates the key before allowing access to the requested endpoint.

How API Keys Function:

1. Identification: The API key identifies the client application or user making the request.
2. Authorization: It grants access to specific API resources and operations based on the permissions associated with that key.
3. Security: API keys should be treated as sensitive credentials, similar to passwords, and kept confidential.

The following table summarizes the primary authentication method:

Getting your credentials

To begin authenticating with the Complete Criminal Checks API, you will need to obtain an API key. This process typically involves creating an account and navigating to the developer or API settings section within your Complete Criminal Checks dashboard.

Steps to Obtain an API Key:

1. Create an Account: If you don't already have one, register for an account on the Complete Criminal Checks website Complete Criminal Checks homepage. This typically involves providing basic contact and business information.
2. Log In to Your Dashboard: Access your Complete Criminal Checks user dashboard using your registered credentials.
3. Navigate to API Settings: Look for a section labeled 'API Settings', 'Developer Settings', or 'Integrations'. The exact naming may vary, but it will be dedicated to managing API access.
4. Generate a New API Key: Within the API settings, there should be an option to generate a new API key. You might be prompted to give your key a descriptive name to help you manage multiple keys for different applications or environments (e.g., 'Production API Key', 'Development API Key').
5. Securely Store Your Key: Once generated, the API key will be displayed. It is crucial to copy this key immediately and store it in a secure location. For security reasons, API keys are often only displayed once and cannot be retrieved if lost. If lost, you may need to generate a new one and revoke the old one.
6. Configure Permissions (if applicable): Depending on your account type and needs, you may be able to configure specific permissions or scopes for your API key, limiting its access to only the necessary API endpoints.

It is recommended to generate separate API keys for different applications or environments (e.g., development, staging, production) to enhance security and simplify key management. If a key is compromised, only the services using that specific key will be affected, and you can revoke it without impacting other integrations.

Authenticated request example

When making an authenticated request to the Complete Criminal Checks API, you will typically include your API key in the request header. The exact header name might be specified in the API documentation, but a common practice is to use an Authorization header with a specific scheme or a custom header like X-API-Key.

Assuming the Complete Criminal Checks API expects the API key in a custom header named X-API-Key, here's an example of how to make an authenticated request using curl, a common command-line tool for making HTTP requests. This example demonstrates fetching a hypothetical criminal record check status.

curl -X GET \
  'https://api.completecriminalchecks.com/v1/checks/status/CHECK_ID_12345' \
  -H 'X-API-Key: YOUR_COMPLETE_CRIMINAL_CHECKS_API_KEY' \
  -H 'Content-Type: application/json'

In this example:

• -X GET specifies the HTTP method (GET in this case, for retrieving data).
• 'https://api.completecriminalchecks.com/v1/checks/status/CHECK_ID_12345' is the endpoint URL for retrieving the status of a specific check. Replace CHECK_ID_12345 with an actual check identifier.
• -H 'X-API-Key: YOUR_COMPLETE_CRIMINAL_CHECKS_API_KEY' is the crucial part for authentication. You must replace YOUR_COMPLETE_CRIMINAL_CHECKS_API_KEY with the actual API key you obtained from your Complete Criminal Checks dashboard.
• -H 'Content-Type: application/json' specifies the content type of the request body, which is good practice even for GET requests.

For programmatic integrations, here's a conceptual example using Python's requests library:

import requests

api_key = "YOUR_COMPLETE_CRIMINAL_CHECKS_API_KEY"
check_id = "CHECK_ID_12345"
api_url = f"https://api.completecriminalchecks.com/v1/checks/status/{check_id}"

headers = {
    "X-API-Key": api_key,
    "Content-Type": "application/json"
}

try:
    response = requests.get(api_url, headers=headers)
    response.raise_for_status()  # Raise an HTTPError for bad responses (4xx or 5xx)
    print("Request successful:")
    print(response.json())
except requests.exceptions.HTTPError as http_err:
    print(f"HTTP error occurred: {http_err}")
except Exception as err:
    print(f"Other error occurred: {err}")

Remember to replace placeholder values with your actual API key and specific check IDs. Always consult the official Complete Criminal Checks API documentation for the most precise and up-to-date instructions on header names, endpoint structures, and required parameters Complete Criminal Checks documentation.

Security best practices

Securing your API keys and the authentication process is paramount when integrating with Complete Criminal Checks, especially given the sensitive nature of criminal background check data. Adhering to robust security practices helps prevent unauthorized access and data breaches.

1. Keep API Keys Confidential

• Treat as Passwords: API keys provide full access to your account's API capabilities. Never embed them directly in client-side code (e.g., JavaScript in a web browser, mobile app bundles) where they can be easily extracted.
• Environment Variables: Store API keys as environment variables on your server or in secure configuration files that are not committed to version control systems (like Git).
• Secure Storage: Use secure secret management services (e.g., AWS Secrets Manager, Google Secret Manager, Azure Key Vault) for production environments AWS Secrets Manager documentation.

2. Use HTTPS/TLS for All Communications

• Encrypt Data in Transit: Always ensure that all API requests to Complete Criminal Checks are made over HTTPS (HTTP Secure) to encrypt data in transit. This protects your API key and sensitive request/response data from interception (man-in-the-middle attacks). Most modern HTTP client libraries enforce HTTPS by default, but it's crucial to verify.

3. Implement IP Whitelisting (if available)

• Restrict Access: If Complete Criminal Checks offers IP whitelisting, configure your API key to only accept requests originating from a predefined list of trusted IP addresses (your server's IP). This adds an extra layer of security, as even if an API key is compromised, it cannot be used from an unauthorized location.

4. Implement Rate Limiting and Monitoring

• Prevent Abuse: Monitor API usage for unusual patterns or spikes that could indicate a compromised key or an attempt at malicious activity. Implement rate limiting on your application's side to prevent excessive requests, which can help mitigate brute-force attacks.

5. Regularly Rotate API Keys

• Minimize Exposure: Periodically generate new API keys and replace old ones. This practice reduces the window of opportunity for a compromised key to be exploited. A typical rotation schedule might be quarterly or annually, or immediately if a compromise is suspected.

6. Principle of Least Privilege

• Limit Permissions: If Complete Criminal Checks allows for granular permissions or scopes on API keys, configure your keys with the minimum necessary permissions required for your application to function. For example, if your application only needs to retrieve check statuses, do not grant it permission to initiate new checks or modify account settings.

7. Secure Logging

• Avoid Logging Keys: Ensure that your application's logs do not inadvertently record or expose API keys or other sensitive credentials. Mask or redact such information before logging.

8. Error Handling and Response Validation

• Handle Failures Gracefully: Implement robust error handling for API requests. Validate responses from the Complete Criminal Checks API to ensure data integrity and detect any unexpected or malicious alterations.