Before you can make API calls, you need a Checkr account. Checkr provides a staging environment for development and a production environment for live checks.
- 1
Sign up
Go to partners.checkrhq-staging.net and create a free developer account. You'll be asked for basic company information.
- 2
Verify your email
After signing up, check your inbox for a verification email from Checkr. Click the link to activate your account.
- 3
Access the staging environment
Log in to dashboard.checkrhq-staging.net with your newly created credentials.
Staging uses fake data — no real background checks are run and no real PII is processed. Always use staging for development and testing. Your staging account is separate from your production account and uses its own API keys.
Staging limitations. Staging is for building and testing, so some production features are intentionally unavailable:
- No adverse action — the adverse action flow does not run in staging.
- No invoices — staging does not generate invoices or bill for usage.
- No analytics — analytics and reporting are not populated in staging.
- Invitations don't expire — staging invitations stay valid indefinitely, unlike production.
Checkr uses separate API keys for staging and production. You'll need a staging key to develop and test, and a production key when you're ready to go live.
Start with staging. Staging keys cannot trigger real background checks or access production data, making them safe for development.
Use staging to build and test your integration before going live.
- 1
Log in to your staging account
Log in to dashboard.checkrhq-staging.net
- 2
Navigate to Developer Settings
Go to Account Settings → Developer Settings.
- 3
Create a Secret key
Click Create Secret Key. Give it a name (e.g. "Local dev") and copy it immediately — it will not be shown again.
- 4
Store it securely
Save the key in your local environment:
export CHECKR_API_KEY=your_staging_key_here
Staging and production are completely separate environments. Candidates, reports, and packages created in staging do not carry over to production.
Checkr issues two types of API keys per environment:
| Key Type | Use |
|---|---|
| Secret key | Server-side only. Full API access. Never expose in client-side code. |
| Publishable key | Client-side use with Checkr's JS SDK only. Safe to expose in frontend code. |
For most API integrations you only need the Secret key.
The Checkr API uses HTTP Basic Auth. Pass your API key as the username with a blank password.
Base URL: https://api.checkr-staging.com/v1
curl -u $CHECKR_API_KEY: https://api.checkr-staging.com/v1/candidatesThe trailing colon (:) after the API key tells curl to send a blank password. This is the correct format for HTTP Basic Auth with Checkr.
Never commit API keys to source control, log files, or error messages.
- Use staging keys during development. Staging keys cannot trigger real checks or access production data.
- Rotate keys immediately if compromised — generate a new one from the Dashboard and revoke the old one.
- Use separate keys for each environment and each service.
- Restrict access to production keys to only the team members who need them.