API keys

Every request needs a key, sent as a bearer token.

text

Authorization: Bearer cl-your-key

Create a key

Sign in to the console with your email.
Click Create a key and give it a name you will recognise, such as the app or server that uses it.
Copy the key straight away.

We store only a scrambled version of each key, so we cannot show it to you again. If you lose it, delete it and create another.

You can have up to 10 keys. Use a separate key for each app, so you can delete one without breaking the others.

Click Delete next to the key in the console. Requests using it stop working straight away.

Delete a key immediately if it may have been exposed, for example pasted into a chat, committed to a public repository or shown in a screenshot.

Keep keys on your server. Never put a key in code that runs in a browser or a mobile app, where anyone can read it.
Store keys in environment variables or a secrets manager, not in your source code.
Give each environment, such as development and production, its own key.

A key can call the API and spend your account's credit. It cannot sign in to the console, change your account or create other keys.