Authentication

Learn how to authenticate with the Cludo API using Basic or SiteKey authentication.

The Cludo API supports two authentication schemes. Which one to use depends on where the request is made and which endpoint you call.

Scheme	Use case
Basic (API Key)	Default for API requests, server-side integrations, index management, crawler URL queues, and search tools
SiteKey	Public client-side search where an API key must not be exposed

Unless an endpoint says otherwise, use Basic authentication. SiteKey is only intended for browser-facing search integrations.

---

Basic (API Key) Authentication

Used for API requests from a trusted backend, scripts, and integrations. Use Basic authentication for index management, crawler URL queues, search tools, and any endpoint where you can keep the API key private.

Building the token

# Format: base64(customerId:apiKey)
echo -n "3:c8fk2L9mK4pQ" | base64
# MzpjOGZrMkw5bUs0cFE=

EU

curl -X POST "https://api.cludo.com/api/v4/3/6/search" \
  -H "Authorization: Basic MzpjOGZrMkw5bUs0cFE=" \
  -H "Content-Type: application/json" \
  -d '{"query": "test"}'

Where to find your credentials

Log in to MyCludo and navigate to Account Settings to find your Customer ID and API key.

---

SiteKey Authentication

Used for public website search widgets and other client-side search integrations. SiteKey authentication exists so browser code can call search-related endpoints without exposing your API key.

Building the token

# Format: base64(customerId:engineId:SearchKey)
# "SearchKey" is a fixed, literal string. Do not replace it with a value.
echo -n "3:6:SearchKey" | base64
# Mzo2OlNlYXJjaEtleQ==

A SiteKey is tied to one specific engine. You cannot use a SiteKey from one engine to authenticate requests to another engine.

EU

curl -X POST "https://api.cludo.com/api/v4/3/6/search" \
  -H "Authorization: SiteKey Mzo2OlNlYXJjaEtleQ==" \
  -H "Content-Type: application/json" \
  -d '{"query": "test"}'

---

Try it: build your token

Use the tool below to generate your SiteKey or Basic authorization header and a ready-to-run cURL command. Switch between SiteKey and Basic to see the correct prefix for each scheme.