Authentication

Learn how to authenticate your API requests to ClipFM.

API Keys

ClipFM uses API keys to authenticate requests. You can create and manage your API keys in the dashboard.

Key features:

  • Secure: Each key is unique and can be revoked at any time
  • Rotatable: Rotate keys regularly for enhanced security
  • Scoped: Create keys with specific permissions (coming soon)

Basic Authentication

Include your API key in the Authorization header as a Bearer token with every request:

Authorization: Bearer YOUR_API_KEY

Security Warning

Never expose your API key in client-side code or public repositories.

Authentication header
const response = await fetch('https://api.clip.fm/v1/clips', {
  headers: {
    'Authorization': 'Bearer YOUR_API_KEY'
  }
});

Storing API Keys Securely

Always store your API keys in environment variables, not in your code:

✅

Do:

  • • Use environment variables
  • • Add .env to .gitignore
  • • Use secret management services in production
❌

Don't:

  • • Hardcode keys in your source code
  • • Commit keys to version control
  • • Share keys publicly
Environment variables
# .env file
CLIPFM_API_KEY=your_api_key_here

# Never commit .env files to version control!
# Add to .gitignore

SDK Authentication

If you're using the ClipFM SDK, authentication is handled automatically:

Tip: The SDK automatically includes your API key in all requests and handles authentication errors gracefully.

SDK authentication
import { ClipFM } from '@clipfm/sdk';

// Initialize with API key
const clipfm = new ClipFM({
  apiKey: process.env.CLIPFM_API_KEY
});

// The SDK automatically includes the API key
// in all requests
const clips = await clipfm.clips.list();

Authentication Errors

Handle authentication errors appropriately in your application:

401 Unauthorized

Invalid or missing API key. Check that you're including the correct key.

403 Forbidden

Valid key but lacks required permissions for this operation.

429 Too Many Requests

Rate limit exceeded. Implement exponential backoff.

Error handling
try {
  const response = await fetch('https://api.clip.fm/v1/clips', {
    headers: {
      'Authorization': 'Bearer YOUR_API_KEY'
    }
  });

  if (!response.ok) {
    switch (response.status) {
      case 401:
        console.error('Invalid API key');
        break;
      case 403:
        console.error('API key lacks required permissions');
        break;
      case 429:
        console.error('Rate limit exceeded');
        break;
      default:
        console.error('API error:', response.status);
    }
  }
} catch (error) {
  console.error('Network error:', error);
}

Best Practices

Rotate keys regularly

Rotate your API keys periodically (e.g., every 90 days) to minimize the impact of potential key compromise.

Use separate keys for environments

Create different API keys for development, staging, and production environments to isolate access.

Monitor key usage

Regularly review your API key usage in the dashboard to detect any unusual activity or unauthorized access.

Implement key rotation in your app

Design your application to support key rotation without downtime by supporting multiple valid keys during transition.

Rate Limiting

API keys are subject to rate limits to ensure fair usage and system stability.

Standard Plan

1,000

requests per hour

Pro Plan

10,000

requests per hour

Enterprise

Custom

Contact sales

Ready to authenticate?

Get your API key and start making authenticated requests.