> ## Documentation Index
> Fetch the complete documentation index at: https://developer.cloakup.me/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> API keys, middleware, scopes, and rate limits

## API key format

| Item         | Value                               |
| ------------ | ----------------------------------- |
| Prefix       | `ck_`                               |
| Secret       | 64 hex characters                   |
| Header       | `Authorization: Bearer ck_<secret>` |
| Content-Type | `application/json`                  |

Example:

```http theme={null}
GET /v1/campaigns?page=1&limit=10 HTTP/1.1
Host: api.cloakup.me
Authorization: Bearer ck_0123456789abcdef...
Accept: application/json
```

Create keys in the [dashboard](https://app.cloakup.me/settings/api-keys). Keys are shown only once at creation.

## Prerequisites (every `/v1` request)

Middleware applied to all `/v1` routes:

1. Valid API key (`Authorization: Bearer ck_...`)
2. Rate limit: **120 requests/minute** per key
3. Plan must have **API keys enabled** (`plan.api_keys_enabled`)
4. Active **cloakup** subscription
5. Route-specific **scope** (see each endpoint)

Failure at any step returns `401` or `403`. See [Errors](/errors).

## Scopes

Each key has one or more scopes. The endpoint rejects requests when the key lacks the required scope.

| Scope              | Description                   |
| ------------------ | ----------------------------- |
| `campaigns:list`   | List campaigns                |
| `campaigns:create` | Create campaign               |
| `campaigns:show`   | Get campaign by ID            |
| `campaigns:update` | Update campaign               |
| `campaigns:delete` | Delete campaign               |
| `campaigns:clone`  | Clone campaign                |
| `campaigns:toggle` | Toggle campaign active status |
| `domains:list`     | List domains                  |
| `domains:create`   | Register domain               |
| `domains:verify`   | Verify domain DNS/certificate |
| `domains:delete`   | Delete domain                 |

Presets in the dashboard:

* **Read only** — `campaigns:list`, `campaigns:show`, `domains:list`
* **Full access** — all scopes above

## IDs

Resource IDs are numeric (`bigint`). JSON may serialize them as numbers or strings depending on the serializer.