API keys and authentication
Creating keys, permissions, the X-Clatter-Account header and keeping keys safe.
- Can I call the Agent API from a browser or mobile app?The API allows cross-origin requests, but never put a clsk_ key in front-end or mobile code. Call it from your server.FAQ
- Can I change a key's permissions or rate limit after creating it?Permissions and rate limit are set when you create a key. To change them, create a new key and revoke the old one.FAQ
- Can I get an Agent API key without using the Console?No. Keys are created in Console › API keys. After that, everything else can be done over the API.FAQ
- Can I start runs for another Clatter Labs account?No. A key only works with its owner's Account ID. For shared work, use Team in the Console so members use the owner's plan and credits.FAQ
- Does the Account ID have to be in capital letters?No. X-Clatter-Account matching is case-insensitive, so CL-7K2M9QXA and cl-7k2m9qxa are treated the same.FAQ
- How many API keys can I have?An account can hold up to 25 API keys. Each key has its own permissions and rate limit.Reference
- How should I store my API key and Account ID in my code?Keep the key in an environment variable or secret manager, never in source code. The docs use CLATTER_API_KEY and CLATTER_ACCOUNT_ID.How-to
- What does the clsk_ at the start of my key mean?All Clatter Labs Console API keys start with clsk_. It helps you and secret scanners recognise them.FAQ
- What is the X-Clatter-Account header and why is it required?X-Clatter-Account carries the Account ID that owns your key. It means a leaked key alone isn't enough to act on your account.Explainer
- Which permissions should I give an Agent API key?Give each key only what it needs: runs:write to start runs, runs:read to read them, account:read for balance and usage.FAQ
- Who owns the API keys in a company account?Keys belong to the account that created them. Requests must send that account's ID. Use the Console Team feature for colleagues.FAQ
- Why can't I see my API key again after creating it?Clatter Labs stores only a keyed hash of each key, so it can't be shown again. Create a new key if you lose it.FAQ
- Why does /agent-config work without a key?It's a public description of the API: version, endpoints, tools and limits. Send a key to also see your key and balance.FAQ
Still need help?
Tried the steps above and still stuck? Email us. We usually reply within the first hour, and always within 24 hours. A full support team is with you.
Infrastructure questions, or permanent deletion of your data
infrastructure@clatterlabs.xyzFor deleting your whole account or the data of one service.