Authentication

Authenticate API, SDK, and CLI requests with Bearer tokens and optional agent keys.

All KorClaw API v1 endpoints except GET /health require a workspace API key in the Authorization header.

API key authentication

curl https://app.korclaw.com/api/v1/agents \
  -H "Authorization: Bearer kc_live_your_api_key_here"

API key format

Production keys: kc_live_ prefix
Test keys: kc_test_ prefix
Keys can be IP-restricted, expired, or revoked
Scoped permissions control access (e.g. approvals:decide, organizations:write)

Agent identity header

Runtime and policy endpoints accept an optional X-KorClaw-Agent-Key header. When an agent has an api_key_hash set, this header is required and must match the stored hash.

bash

curl -X POST https://app.korclaw.com/api/v1/policy/evaluate \
  -H "Authorization: Bearer kc_live_your_api_key_here" \
  -H "X-KorClaw-Agent-Key: ka_your_agent_key_here" \
  -H "Content-Type: application/json" \
  -d '{"input":{"action":"deploy","agent":"ops-bot"}}'

Never expose keys

Store API keys and agent keys in environment variables or a secrets manager. Never commit keys to source control or pass them in URLs.