Authentication

Clausum uses Bearer authentication:

Authorization: Bearer <your_key_or_token>

Partner API requests use your stage hostname — sandbox https://sandbox.clausum.ai, production https://dashboard.clausum.ai, or a dedicated host from your account team. See Access & environments.

Three key types

Create keys in Dashboard → Connections → API keys (ingest keys on Inbound (webhooks) tab).

You need…	Dashboard label	Prefix	Typical use
Browser checkout	Publishable	`clm_pub_`	SDK, client-side assess
Backend integration	Secret	`clm_sk_`	Assess, report fraud, payout
Pipe events in	Webhook ingest	`clm_wh_`	`POST /api/webhooks/ingest` only

Publishable

clm_pub_* — assess only. Safe in the browser.

Secret

clm_sk_* — server only. Never ship to clients.

Ingest

clm_wh_* — ingest endpoint only.

Keys are shown once at creation. Revocation in Connections is immediate.

Using a key

curl "https://dashboard.clausum.ai/api/v1/assess" \
  -H "Authorization: Bearer clm_sk_xxx" \
  -H "Content-Type: application/json" \
  -d '{ "amount": 10.00, "amount_unit": "major", "currency": "USD" }'

const res = await fetch(`${process.env.CLAUSUM_API_BASE}/api/v1/assess`, {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.CLAUSUM_SECRET_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({ amount: 10.0, amount_unit: "major", currency: "USD" }),
})

Use the Authorization header — api_key query parameters are disabled in production.

Permissions (secret keys)

Endpoint	Key type	Permission
`POST /api/v1/assess`	Publishable or secret	`assess`
`POST /api/v1/assess/payout`	Secret only	`assess`
`POST /api/v1/report-fraud`	Secret only	`fraud:report`
`POST /api/v1/network/intelligence`	Secret only	`network:contribute` or `fraud:report`
`GET /api/v1/network/intelligence`	Secret only	`network:signals:read`, `network:contribute`, `fraud:report`, or `assess`
`POST /api/webhooks/ingest`	Ingest (`clm_wh_`)	valid ingest key
`GET/POST /api/v1/merchant/*`	Secret	per-key scopes

Dashboard session (not API keys)

Management routes (blocklists, cases, submerchants, network/membership, …) use a Supabase JWT after sign-in — not partner keys.

Errors

Status	Meaning
`401`	Missing, invalid, disabled, or revoked key
`403`	Wrong key type or missing permission
`429`	Rate limit exceeded

See Errors and API keys.

Get started

Integrate by client type

Solutions & prevention

Capabilities — events & ops

Dashboard

Core concepts

Reference

Three key types

Publishable

Secret

Ingest

Using a key

Permissions (secret keys)

Dashboard session (not API keys)

Errors

​Three key types

Publishable

Secret

Ingest

​Using a key

​Permissions (secret keys)

​Dashboard session (not API keys)

​Errors

Three key types

Using a key

Permissions (secret keys)

Dashboard session (not API keys)

Errors