Authentication

Each API key belongs to one verified account and uses that account’s credits.

Send your key in a header

X-API-Key: cc_your_secret_key

Bearer authentication is also accepted. A key is displayed once when created. Clearcut stores its hash. Revoke a key from your account to stop integrations using it immediately.

Access your files securely

Job IDs are not access tokens. Reading a job, file or batch requires the same account or browser session that owns it. Another account gets 404.

Browser sessions

The website uses secure, HTTP-only session cookies. Signup requires email verification. Managing API keys and billing also requires a browser session; image API keys cannot perform these account actions. Password reset revokes existing sessions. The daily free allowance uses a separate signed browser identity.