Authentication

Every call to the cloro API is verified with a secret API key sent as a Bearer token, so requests are tied to your account and billed correctly.

Overview

cloro authenticates requests with a bearer credential rather than session cookies or signed request bodies. Each request must carry an Authorization header whose value is the word Bearer followed by a single space and your API key. Requests that omit the header, use the wrong scheme, or present a key that has been revoked are rejected before any work is scheduled.

Because the key alone grants full access to your account, treat it like a password. Keep it on the server side, load it from configuration or a secrets manager, and never commit it to a repository or ship it in browser or mobile code where end users could read it.

Header format

Attach the following header to every request against the API base URL https://api.cloro.cloud/v1:

Example request

A minimal authenticated call adds the bearer header to any endpoint, such as submitting a monitoring prompt:

curl -X POST https://api.cloro.cloud/v1/monitor \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"prompt": "Your prompt here", "model": "CHATGPT"}'

Response example

When the credential is missing, malformed, or no longer valid, the API returns 401 Unauthorized with a consistent error envelope instead of processing the request:

{
  "success": false,
  "error": "Invalid or missing API key"
}

Notes

• Include the Bearer prefix; a bare key with no scheme is treated as unauthenticated.
• Generate, rotate, and revoke keys from your account dashboard. Rotating a key immediately invalidates the previous value, so update deployments before removing the old key.
• Store the key in an environment variable or secrets manager and read it at runtime rather than hardcoding it.
• A repeated 401 usually means a copy or paste error, a rotated key, or a key scoped to a different environment. Persistent problems can be raised with [email protected].