Keep authentication on your server
Create and verify your account, then use an active API key from the dashboard. Store the secret in your server environment, not in browser code, public repositories or URLs. Keys are shown in full only when created. If exposed, delete the key and create a replacement.
Call GET /api/v1/lookup/{number} from your server using either Authorization: Bearer or x-api-key, not both. Use the API reference for the exact request, response fields and working code examples.
Build a reviewable business workflow
For supplier onboarding, retrieve a record and compare the submitted identifier and legal name. For business-customer registration, display available business details for confirmation. Send ambiguous names and mismatches for review rather than silently rejecting an application.
Save the returned data period alongside any result you retain. The API uses the active published registry release; activating a later release changes the source used for subsequent requests without requiring a new endpoint.
Handle errors without losing user input
Distinguish a not-found outcome from invalid input, an authentication error, a rate limit or a temporary service failure. Keep the form data available for correction or retry. Follow Retry-After when supplied and avoid repeated automatic retries for invalid credentials.
Account requests share a rate limit of 60 per minute and a cumulative ceiling of 1,000,000 admitted requests across keys and entitled sessions. The ceiling does not reset when a key is deleted or access is renewed. Review the fair-use policy before designing high-volume workflows.
Try the tools and read the documentation
Saudi CR Pro is an independent service, not affiliated with the Ministry of Commerce or any government body. For current official information or a certified extract, use the Ministry of Commerce inquiry service.