Why do API requests need my Account ID as well as the key?
Every request to the Agent API, the Model API and Code Buckets sends two things:
Authorization: Bearer clsk_...
X-Clatter-Account: CL-XXXXXXXX
Why two?#
A key alone isn't enough. The request must also name the account that owns the key. That gives you two protections:
- A key that leaks without its Account ID can't be used. Someone who finds a key in a log or a screenshot still needs to know which account it belongs to.
- A key sent with someone else's Account ID is refused. It can't be used to act on a different account.
What happens if it's wrong#
| Situation | Response |
|---|---|
No X-Clatter-Account header | 401 missing_account_id |
| Account ID doesn't own the key | 401 account_mismatch |
| Key wrong or revoked | 401 invalid_api_key |
This still isn't a reason to be careless with keys. If a key leaks, revoke it straight away.
See Authentication.
Learn more#
Still need help?#
- General support: support@clatterlabs.com or team@clatterlabs.xyz
- Infrastructure questions, or permanent deletion of your data (your whole account or one service): infrastructure@clatterlabs.xyz
We usually reply within the first hour, and always within 24 hours. A full support team is with you.
Related articles
Still need help?
Tried the steps above and still stuck? Email us. We usually reply within the first hour, and always within 24 hours. A full support team is with you.
Infrastructure questions, or permanent deletion of your data
infrastructure@clatterlabs.xyzFor deleting your whole account or the data of one service.