> ## Documentation Index
> Fetch the complete documentation index at: https://mintlify.com/cline/cline/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> How to authenticate with the Cline API using API keys — getting a key, sending it in requests, and handling auth errors.

Every request to the Cline API must include a valid API key in the `Authorization` header. Requests without a valid key return a `401 Unauthorized` error.

## Get an API key

<Steps>
  <Step title="Sign in to app.cline.bot">
    Go to [app.cline.bot](https://app.cline.bot) and sign in with your Cline account.
  </Step>

  <Step title="Open API Keys">
    Navigate to **Settings** > **API Keys**.
  </Step>

  <Step title="Create and copy your key">
    Click **Create API Key**. Copy it immediately — you cannot view it again after leaving this page.
  </Step>
</Steps>

<Warning>
  Treat your API key like a password. Do not commit it to version control or share it publicly.
</Warning>

## Send the key in requests

Include your API key as a Bearer token in the `Authorization` header:

```
Authorization: Bearer YOUR_API_KEY
```

### curl example

```bash theme={null}
curl -X POST https://api.cline.bot/api/v1/chat/completions \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "anthropic/claude-sonnet-4-6",
    "messages": [{"role": "user", "content": "Hello!"}]
  }'
```

### Use an environment variable

Store the key in an environment variable instead of hardcoding it:

```bash theme={null}
export CLINE_API_KEY="your_api_key_here"

curl -X POST https://api.cline.bot/api/v1/chat/completions \
  -H "Authorization: Bearer $CLINE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"model": "anthropic/claude-sonnet-4-6", "messages": [{"role": "user", "content": "Hello"}]}'
```

### Use a .env file

```bash theme={null}
# .env — add this file to .gitignore
CLINE_API_KEY=your_api_key_here
```

```python theme={null}
import os
from openai import OpenAI

client = OpenAI(
    base_url="https://api.cline.bot/api/v1",
    api_key=os.environ["CLINE_API_KEY"],
)
```

## Revoke a key

You can delete an API key at any time from **Settings > API Keys** in [app.cline.bot](https://app.cline.bot). Deleted keys stop working immediately.

You can also manage keys via the API:

```bash theme={null}
# List your keys
curl https://api.cline.bot/api/v1/api-keys \
  -H "Authorization: Bearer YOUR_API_KEY"

# Delete a key
curl -X DELETE https://api.cline.bot/api/v1/api-keys/KEY_ID \
  -H "Authorization: Bearer YOUR_API_KEY"
```

## Optional headers

You can include these optional headers to improve usage tracking and debugging:

| Header         | Description                                     |
| -------------- | ----------------------------------------------- |
| `HTTP-Referer` | Your application's URL. Appears in usage logs.  |
| `X-Title`      | Your application's name. Appears in usage logs. |

## Auth errors

If authentication fails, the API returns a `401` HTTP status with this body:

```json theme={null}
{
  "error": {
    "code": 401,
    "message": "Invalid API key",
    "metadata": {}
  }
}
```

Common causes and fixes:

| Error                  | Cause                                              | Fix                                                                                            |
| ---------------------- | -------------------------------------------------- | ---------------------------------------------------------------------------------------------- |
| `401 Unauthorized`     | Missing or invalid API key                         | Check the `Authorization` header and verify your key at [app.cline.bot](https://app.cline.bot) |
| `403 Forbidden`        | Key does not have access to the requested resource | Check key permissions                                                                          |
| `402 Payment Required` | Account has no remaining credits                   | Add credits at [app.cline.bot](https://app.cline.bot)                                          |

## Security best practices

**Do:**

* Store keys in environment variables or a secrets manager (e.g., AWS Secrets Manager, HashiCorp Vault)
* Use separate keys for development and production
* Rotate keys periodically
* Delete keys you no longer use

**Do not:**

* Commit keys to version control
* Share keys in chat, email, or issue trackers
* Embed keys in client-side code (browsers, mobile apps)
* Log keys in application output

<CardGroup cols={2}>
  <Card title="Chat completions" icon="message" href="/api/chat-completions">
    Make your first authenticated API request.
  </Card>

  <Card title="Errors" icon="triangle-exclamation" href="/api/errors">
    Full list of error codes and how to handle them.
  </Card>
</CardGroup>