Authentication & Tokens
Private endpoints (under /v1/me/...) require authentication. You must include a Bearer token in the Authorization header of your request. Tokens are generated from your user profile on the main website.
Generating a Token
- Log in to your account at
https://clashcloud.dev. - Navigate to your Profile page.
- Locate the API Tokens section on the right side.
- Click + Create.
- Provide a name for the token, select the required scopes, and choose an expiration period.
- Click Create Token.
Important: The plain-text token will be displayed only once right after creation. Make sure to copy it immediately and store it securely. If you lose it, you will need to revoke it and generate a new one.
Using the Token
Pass the token as a Bearer token in the Authorization header:
curl -X GET https://api.clashcloud.dev/v1/me \
-H "Authorization: Bearer YOUR_TOKEN_HERE" \
-H "Accept: application/json"Scopes When creating a token, you can restrict its permissions using scopes. By default, only the read:public scope is selected.
| Scope | Description |
|---|---|
| read:public | Access public data (news, projects, users, tags). |
| read:private | Access your private data (email, own drafts, etc.). |
| write:projects | Create, update, and delete your projects. |
| write:news | Create and update your news articles. |
| write:comments | Delete your own comments. |
Token Expiration & Revocation
- Expiration: You can choose a token lifespan of 30 days, 90 days, 1 year, or "Never". Expired tokens are automatically rejected.
- Revocation: You can revoke any active token at any time by clicking the Revoke button next to it in your Profile. Revoked tokens stop working immediately.
Single Sign-On (SSO) via Cookies
If you are already logged in on clashcloud.dev and are making a request from a browser, the API can authenticate you automatically using the shared session cookie.
This is useful for frontend integrations (like a dashboard) where you don't want to expose a Bearer token in the client-side code.