# Quickstart (/quickstart)

## Prerequisites [#prerequisites]

- Active **cloakup** subscription with API keys enabled on your plan
- An API key with at least `campaigns:list` (or the scopes you need)

Create keys in the dashboard: [app.cloakup.me → Settings → API Keys](https://app.cloakup.me/settings/api-keys).

## Authenticate [#authenticate]

Every `/v1` request requires:

```http
Authorization: Bearer ck_<your-secret>
Content-Type: application/json
```

Keys start with `ck_` followed by 64 hex characters.

## First request [#first-request]

<Steps>
<Step>

### List campaigns [#list-campaigns]

```bash
curl -sS \
  -H "Authorization: Bearer ck_YOUR_KEY" \
  "https://api.cloakup.me/v1/campaigns?page=1&limit=10"
```

</Step>
<Step>

### Check the response [#check-the-response]

A `200` response includes `count` and `data` (array of campaigns). See [Errors](/errors) if you get `401`, `403`, or `429`.

</Step>
<Step>

### Create a domain (if needed) [#create-a-domain-if-needed]

```bash
curl -sS -X POST \
  -H "Authorization: Bearer ck_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"name":"track.example.com"}' \
  "https://api.cloakup.me/v1/domains"
```

</Step>
<Step>

### Verify the domain [#verify-the-domain]

```bash
curl -sS -X PATCH \
  -H "Authorization: Bearer ck_YOUR_KEY" \
  "https://api.cloakup.me/v1/domains/DOMAIN_ID/verify"
```

Repeat until `verified: true`.

</Step>
<Step>

### Create a campaign [#create-a-campaign]

Use the [minimal production-safe body](/guides/campaign-create#minimal-example). Do **not** set `filters.deny_always: true` unless you are testing.

</Step>
</Steps>

## Anti-patterns [#anti-patterns]

<Callout type="warn">

Avoid these common mistakes — they cause `422` errors or broken production traffic.

</Callout>

- Do **not** set `filters.deny_always: true` unless you explicitly want review/test mode
- Do **not** copy the full `filters` object from a GET response into POST/PUT
- Do **not** invent country codes or browser languages — follow [Campaign filters](/guides/campaign-filters)
- Do **not** send `filters.query.params` values as a plain string — always `string[]` (e.g. `"utm_source": ["google"]`)
- Do **not** put `http(s)://`, `www`, or `/` in domain `name`
- Do **not** treat PUT as partial PATCH — send a **full** campaign body
- Do **not** use `https://api.example.com` — use `https://api.cloakup.me`

## Environment variables [#environment-variables]

| Variable | Description |
|----------|-------------|
| `CLOAKUP_API_URL` | Base URL without trailing slash (e.g. `https://api.cloakup.me`) |
| `CLOAKUP_API_KEY` | Full key `ck_...` |

## Next steps [#next-steps]

<Cards>
  <Card title="Scopes" href="/authentication#scopes">

Which permission each endpoint needs.

  </Card>
  <Card title="Campaign create" href="/guides/campaign-create">

Defaults, business rules, and minimal example.

  </Card>
  <Card title="MCP integration" href="/reference/mcp">

Use Cloakup from Cursor or other MCP clients.

  </Card>
  <Card title="Help center" href="https://help.cloakup.me/pt-br/article/chaves-de-api-jrrc7a/">

Dashboard guide for creating and managing keys.

  </Card>
</Cards>