Authentication

Browser (web)

Better Auth cookies on the website origin. Google OAuth and email/password both work here. Create and revoke public API keys on Security settings.

Public API

Create a user API key or an account API key on the website, then send:

Authorization: Bearer ctk_…

X-API-Key: ctk_…

User API keys inherit their owner’s current workspace role. Account API keys have an assigned workspace role with the same permissions as a user in that role. Neither can read production secret values; runtime production reads require a scoped vault key.

The secret is shown once at creation. Sign-in, sign-up, and password reset stay on the website. They are not /v1 routes.

CLI

Run clanker auth login to approve a device code in your browser. CLI sessions use dedicated /cli/oauth/* endpoints and the {API_URL}/cli audience. Access tokens expire after 15 minutes; refresh tokens rotate and expire after 30 days. Revoke sessions on Security settings or run clanker auth logout.

For unattended use, set CLANKER_API_KEY to a user or account API key. Management commands never accept vault keys. See Secrets Vault for permissions and commands.

Agents

MCP and /agent/v1 use agent OAuth, not API keys:

Authorization UI: website /agent/oauth/authorize
Token and registration: API origin /agent/oauth/*
Resource: {API_URL}/agent/mcp