> ## Documentation Index
> Fetch the complete documentation index at: https://docs.clipstake.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Create an API key, send it with each request and revoke it.

Every request needs an API key. An API key starts with `ck_live_`.

## Create an API key

1. Sign in to the ClipStake web app.
2. Open **Settings**, then **API keys**.
3. Select **Create API key** and give the key a name.
4. To let the key create campaigns, select **Can create campaigns**.
5. Copy the key. ClipStake shows it only once.

The agency owner and agency admins can create and revoke API keys. Other team
members cannot.

An agency can have up to 10 active API keys.

## Send the API key

Send the API key in the `Authorization` header of each request.

```bash theme={null}
curl "https://app.clipstake.com/api/v1/agency/brands" \
  --header "Authorization: Bearer ck_live_..."
```

The API does not accept a key in the URL or in a cookie.

## What an API key can do

An API key belongs to your agency, not to the person who created it. It
continues to work when that person leaves the agency.

The key reads the brands that your agency owner can see in ClipStake. It also
reads the campaigns and clips of those brands.

A key with write access can also create campaigns for those brands. You choose
this when you create the key. You cannot change it later. To give a tool write
access, create a new key. A key without write access gets `403 forbidden` from
`POST /campaigns`.

## Keep the API key secret

* Store the API key on your server.
* Do not put the API key in a browser, a mobile app or a public repository.
* Create one API key for each tool. Then you can revoke one tool without
  stopping the others.
* Give write access only to a tool that must create campaigns.

## Revoke an API key

Open **Settings**, then **API keys**, and select **Revoke** on the key. The key
stops working at once. You cannot restore a revoked key.

Requests with a revoked, missing or unknown key return `401 unauthorized`.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.