Quickstart

Prerequisites

Active cloakup subscription with API keys enabled on your plan
An API key with at least campaigns:list (or the scopes you need)

Create keys in the dashboard: app.cloakup.me → Settings → API Keys.

Authenticate

Every /v1 request requires:

Authorization: Bearer ck_<your-secret>
Content-Type: application/json

Keys start with ck_ followed by 64 hex characters.

First request

List campaigns

curl -sS \
  -H "Authorization: Bearer ck_YOUR_KEY" \
  "https://api.cloakup.me/v1/campaigns?page=1&limit=10"

Check the response

A 200 response includes count and data (array of campaigns). See Errors if you get 401, 403, or 429.

Create a domain (if needed)

curl -sS -X POST \
  -H "Authorization: Bearer ck_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"name":"track.example.com"}' \
  "https://api.cloakup.me/v1/domains"

Verify the domain

curl -sS -X PATCH \
  -H "Authorization: Bearer ck_YOUR_KEY" \
  "https://api.cloakup.me/v1/domains/DOMAIN_ID/verify"

Repeat until verified: true.

Create a campaign

Use the minimal production-safe body. Do not set filters.deny_always: true unless you are testing.

Anti-patterns

Avoid these common mistakes — they cause 422 errors or broken production traffic.

Do not set filters.deny_always: true unless you explicitly want review/test mode
Do not copy the full filters object from a GET response into POST/PUT
Do not invent country codes or browser languages — follow Campaign filters
Do not send filters.query.params values as a plain string — always string[] (e.g. "utm_source": ["google"])
Do not put http(s)://, www, or / in domain name
Do not treat PUT as partial PATCH — send a full campaign body
Do not use https://api.example.com — use https://api.cloakup.me