# Authentication

Every request needs the `x-api-key` header.

```
x-api-key: ck_live_<your-secret>
```

Keys are minted in [API Console → API Keys](https://clodo.ai/api-console?tab=keys).

## Minting an API key

1. Open the **API Keys** tab.
2. Click **Mint new key**.
3. Copy the raw secret. It is shown once.

The table shows the key prefix and last four characters after creation.

Allow up to 60 seconds after minting before first use.

## Revoking a key

Click the trash icon next to a key. Revocation is immediate. In-flight requests with that key fail at the next request boundary with `403 Forbidden` or `401 unauthorized`. Other keys on the account keep working.

## Header rules

- Header name is `x-api-key`.
- Send the raw secret value. No `Bearer` prefix, no base64 wrapping.
- Do not put the key in the URL or request body.

## Errors

- `403 Forbidden` — `x-api-key` header missing, revoked, or not recognized. Returned by the edge with body `{"message":"Forbidden"}`.
- `402 insufficient_credits` — balance hit zero. Top up in the **Credits** tab.
- `403 permission_denied` — key is valid but the account is not eligible for the public API.

See [Error Envelope](https://docs.clodo.ai/api-reference/errors) for the full schema and code list.