Can I put my Model API key in a website or mobile app?

No. Anything shipped to a browser or a phone can be read by its users, so a key there is a public key. Even with CORS allowed, keep the key on your server.

The safe pattern:

1. Your app calls your backend.
2. Your backend checks who the user is and calls the Model API with the key.
3. Your backend returns or streams the answer.

That also lets you filter user text before it reaches the API, which matters because end users' text counts against your account under the Abuse policy. Example: Stream to a browser without exposing your key.

Good to know#

• If calls fail unexpectedly, check status.clatterlabs.com before debugging further.
• Retry only 429 and 5xx errors, with backoff; honour Retry-After when it's sent. Which errors to retry
• Base URL: https://api.gateway.clatterlabs.xyz/v1, with Authorization: Bearer clsk_... and X-Clatter-Account: CL-... on every call. Quick reference

Still need help?#

• General support: support@clatterlabs.com or team@clatterlabs.xyz
• Infrastructure questions, or permanent deletion of your data (your whole account or one service): infrastructure@clatterlabs.xyz

We usually reply within the first hour, and always within 24 hours. A full support team is with you.