Keys and authentication
API keys, the models:invoke permission and the X-Clatter-Account header.
- Can Clatter Labs see my API key?No. The key is shown to you once; Clatter Labs stores only a keyed hash, so it can't be read back.FAQ
- Can I limit a key to one model, like Flash only?Keys are scoped by permission, not by model. Choose the model in your code, or on a team set spending limits.FAQ
- Can I put my Model API key in a website or mobile app?No. Anyone can read keys in front-end code. Call the Model API from your server instead.FAQ
- Can I restrict a key to certain IP addresses?The docs don't describe IP restrictions for keys. Protect keys with the Account ID header, server-side storage and quick revocation.FAQ
- Can one key call both the Model API and the Agent API?Keys carry permissions. Give one key models:invoke plus runs permissions, or keep separate keys per product.FAQ
- Do API keys expire on their own?You choose when you create the key: 30 days, 90 days (default), 1 year or Never. Expired keys answer 401 expired_api_key.FAQ
- How do I create an API key for the Model API?In Console › API keys, create a key with the Model API preset (models:invoke), pick a rate limit and copy it once.How-to
- How do I revoke an API key, and what happens to requests using it?Revoke from Console › API keys. Requests with that key fail at once with 401 invalid_api_key.How-to
- How do I rotate a Model API key without downtime?Create the new key, deploy it, confirm traffic moved, then revoke the old key.How-to
- How many API keys can I have?Up to 25 keys per account, each with its own permissions and rate limit.FAQ
- I lost my API key. Can I see it again?No. Keys are shown once and only a keyed hash is stored. Create a new key and revoke the old one.FAQ
- Is my Account ID a secret?Treat it as private but not as sensitive as a key. It's needed on every request alongside the key.FAQ
- My API key leaked. What should I do?Revoke it immediately in the Console, create a new key, then check Logs and Usage for calls you didn't make.Troubleshooting
- What does a Clatter Labs API key look like?Keys start with clsk_. Send them as Authorization: Bearer clsk_... with no extra spaces or quotes.Reference
- What is an API key, in simple words?An API key is a secret password your program uses to prove it's allowed to use your Clatter Labs account.Explainer
- What is the models:invoke permission?models:invoke lets a key call models through the Model API. Without it, calls answer 403 insufficient_scope.Reference
- Where do I find my Account ID?Your Account ID looks like CL-7K2M9QXA and is shown in Console › Settings.How-to
- Why does the Model API need both a key and X-Clatter-Account?The Account ID header names the key's owner, so a key that leaks on its own can't be used.Explainer
Still need help?
Tried the steps above and still stuck? Email us. We usually reply within the first hour, and always within 24 hours. A full support team is with you.
Infrastructure questions, or permanent deletion of your data
infrastructure@clatterlabs.xyzFor deleting your whole account or the data of one service.