Authentication

Every request carries an API key in the Authorization header as a bearer token. Workspace owners create and revoke keys under Settings → API.

A key belongs to one workspace and acts with the editor role there. It can read and change links, rotators, reports, domains and webhooks, but cannot change the workspace itself, its members or its API keys.

Keys start with clk_. Treat them like passwords: keep them on your server, never in browser code or a public repository. Revoke a key the moment it may have leaked; requests with it fail immediately.

A missing, wrong or revoked key gets 401 with the code auth.invalid_token.