Can I call the API straight from my website's JavaScript?

The APIs allow cross-origin requests (that's what makes the docs' Try it buttons work), but that doesn't make it safe to put a key in your website's code. Anyone can open the browser's developer tools and copy it.

Do this instead#

1. Your website calls your own server.
2. Your server adds the key and Account ID and calls Clatter Labs.
3. Your server returns only what the browser needs.

This also lets you add your own checks, like per-user limits and content filters, before anything reaches Clatter Labs.

The same goes for mobile apps and desktop apps you distribute: keys inside them can be extracted.

Good to know#

• Never put a key in front-end code, a mobile app, a public repo or a screenshot.
• Give each integration its own key with only the permissions it needs.

Learn more#

• Limits and best practices
• API keys guide
• Abuse policy

Still need help?#

• General support: support@clatterlabs.com or team@clatterlabs.xyz
• Infrastructure questions, or permanent deletion of your data (your whole account or one service): infrastructure@clatterlabs.xyz

We usually reply within the first hour, and always within 24 hours. A full support team is with you.