Skip to main content
Every /v1/ endpoint authenticates with an API key, sent as a bearer token. Getting your first key is a three-step path: sign up at app.usecleff.com/signup (or register a Business with POST /v1/registration), verify the email address you registered with, then sign in to the dashboard and create a key under Settings → API keys. Registration itself returns no key; issuance is gated on email verification.

​
API key

Send the key in the Authorization header:

​
Key shape

ck_<environment>_<id_prefix>_<secret>
  • environment: sandbox or production
  • id_prefix: 8 hex chars, public-safe identifier shown in dashboards
  • secret: random, never stored in plaintext (HMAC-SHA256 verifier only, per ADR-0008)
The key binds both the Business and the environment it was issued for: a sandbox key cannot read or modify production data, and a key issued to one Business can never reach another’s. Cross-tenant and cross-environment reads return 404; the row is simply not visible to the key.

​
Rotation

The plaintext key is returned exactly once at creation time; store it when you receive it, because Cleff keeps only a verifier and cannot show it to you again. If you lose a key, rotate it from the dashboard: rotation issues a new key and revokes the old one immediately.