Authentication
Every request to https://api.clearance.rest carries a project API key in the X-API-Key header.
curl https://api.clearance.rest/account/balance \ -H "X-API-Key: cr_live_..."API keys
Section titled “API keys”- A key looks like
cr_live_followed by 32 hex characters. - A key belongs to one project. Requests are made on behalf of that project and charged to the balance of the team that owns it. Numbers, mailboxes and webhooks you create are visible to the project’s keys only.
- Create and revoke keys in the console under the project’s API keys tab. A key is shown in full once, at creation. Only a hash is kept, so a lost key cannot be recovered: create a new one.
- Revoking a key stops it immediately. Give each service its own key so you can revoke one without touching the others. Keys also show when they were last used.
- Keep keys on your server. The SDKs read
CLEARANCE_REST_API_KEYfrom the environment when you do not pass one explicitly.
Failures
Section titled “Failures”| Status | error.code |
Meaning |
|---|---|---|
| 401 | missing_api_key |
The X-API-Key header is absent. |
| 401 | invalid_api_key |
The key is unknown or revoked, or its project or team no longer exists. |
| 403 | email_not_verified |
The user who created the key has not verified their email address. |
| 403 | team_suspended |
The team or project is suspended. error.details.reason says why. |
The full error format is on Errors.
Endpoints without a key
Section titled “Endpoints without a key”A few endpoints take no API key because their caller has none yet: the endpoints behind authorization links, which the hosted link page calls with the link’s token, and the endpoints the Android app uses to connect a device number. In the API reference they are the operations that list no Authorizations.
Other credentials
Section titled “Other credentials”AI agents authenticate to the MCP server with an OAuth sign-in or an MCP token, not with an API key. The console uses a session cookie. Neither works against the REST API.