Clico Authentication: API Key Setup and Security (2026)

Authentication overview

Clico's API utilizes a token-based authentication mechanism where clients authenticate by providing a unique API key with each request. This method, commonly referred to as Bearer token authentication, grants access to the requesting application based on the permissions associated with the provided key. The Clico API is designed as a RESTful service, allowing developers to manage URL shortening, custom domains, and link analytics programmatically. All API interactions occur over HTTPS to ensure data encryption during transit, protecting both the API key and the data exchanged.

The core principle is that the API key acts as a secret that identifies and authenticates the user or application making the request. Proper handling and protection of this key are essential to prevent unauthorized access to Clico account resources, such as creating new short links, updating existing ones, or retrieving sensitive analytics data. Clico's authentication system simplifies integration by requiring only a single credential for most operations, making it suitable for server-side applications and secure client-side environments.

Supported authentication methods

The primary and currently supported authentication method for the Clico API is API Key authentication, implemented as a Bearer token. This approach is widely adopted for its simplicity and effectiveness in securing API access for applications that can securely store and transmit credentials.

Clico's Node.js SDK facilitates this authentication process by providing helper functions to include the API key correctly in requests, abstracting the underlying HTTP header management. For direct API calls, developers must manually construct the Authorization header.

Getting your credentials

To interact with the Clico API, you must first obtain an API key. This key is generated and managed within your Clico account dashboard. The process generally involves:

1. Log In to Clico Dashboard: Access your Clico account by navigating to the Clico homepage and logging in with your registered credentials.
2. Navigate to API Settings: Once logged in, locate the section related to API access or developer settings. This is typically found under 'Settings', 'Account', or a dedicated 'API' menu item. For detailed steps, refer to the Clico official documentation.
3. Generate an API Key: Within the API settings, you will find an option to generate a new API key. Clico may allow you to name your API keys for better organization, especially if you plan to use multiple keys for different applications or environments (e.g., development, staging, production).
4. Copy and Securely Store the Key: After generation, the API key will be displayed. It is crucial to copy this key immediately and store it in a secure location. For security reasons, Clico often displays the key only once upon creation, and you may not be able to retrieve it again if lost. If lost, you would typically need to generate a new key and revoke the old one.
5. Key Management: The API settings area also allows you to manage your existing API keys, including options to revoke or regenerate them. Regularly rotating API keys is a recommended security practice.

Always treat your API key as sensitive information, similar to a password. Do not hardcode it directly into client-side code, commit it to version control systems, or expose it in public repositories.

Authenticated request example

Once you have your Clico API key, you can use it to make authenticated requests to the API. The key must be included in the Authorization header of your HTTP request, prefixed with the Bearer scheme.

Here's an example of how to make an authenticated request to create a short link using cURL:

curl -X POST \
  https://api.clico.io/v1/links \
  -H 'Content-Type: application/json' \
  -H 'Authorization: Bearer YOUR_API_KEY' \
  -d '{ "long_url": "https://www.example.com/very/long/path/to/a/resource" }'

In this example:

• YOUR_API_KEY should be replaced with the actual API key you obtained from your Clico dashboard.
• The -H 'Authorization: Bearer YOUR_API_KEY' part is where the API key is passed for authentication.
• The -H 'Content-Type: application/json' header specifies the format of the request body.
• The -d flag is used to send the JSON payload containing the long_url you wish to shorten.

For Node.js developers, the Clico SDK simplifies this process. After initializing the SDK with your API key, subsequent API calls will automatically include the authentication header. Refer to the Clico API Reference for specific endpoint details and available parameters.

const Clico = require('clico-sdk'); // Assuming 'clico-sdk' is the package name

const clico = new Clico('YOUR_API_KEY');

async function createShortLink() {
  try {
    const response = await clico.links.create({
      long_url: 'https://www.example.com/another/long/url'
    });
    console.log('Short link created:', response.data);
  } catch (error) {
    console.error('Error creating short link:', error.message);
  }
}

createShortLink();

This Node.js example demonstrates how the SDK handles the authentication details internally, allowing developers to focus on the business logic of their application.

Security best practices

Securing your API keys and authentication processes is paramount to protect your Clico account and data. Adhere to the following best practices:

• Protect Your API Keys:
  • Environment Variables: Store API keys as environment variables rather than hardcoding them directly into your application code. This prevents keys from being exposed in source control.
  • Configuration Files: If using configuration files, ensure they are not publicly accessible and are excluded from version control systems (e.g., via .gitignore).
  • Dedicated Secret Management: For production environments, consider using dedicated secret management services (e.g., AWS Secrets Manager, Google Secret Manager, Azure Key Vault, or HashiCorp Vault) to store and retrieve API keys securely.
• Use HTTPS for All API Calls: Clico's API enforces HTTPS, ensuring that all communications between your application and the API are encrypted. This prevents eavesdropping and tampering with API keys and data in transit, aligning with industry standards for secure web communication documented by organizations like the W3C Web Security FAQ.
• Implement Rate Limiting and Error Handling: While Clico handles its own API rate limits, your application should implement robust error handling for authentication failures and rate limit responses. This prevents denial-of-service attacks against your own application and provides a better user experience.
• Regularly Rotate API Keys: Periodically generate new API keys and revoke old ones. This practice minimizes the window of exposure if a key is compromised. The frequency of rotation depends on your security policy and risk assessment.
• Restrict Key Permissions (if available): If Clico introduces granular permissions for API keys in the future, assign only the minimum necessary permissions to each key. This principle of least privilege reduces the impact of a compromised key.
• Monitor API Usage: Regularly review your Clico account's API usage logs for unusual activity. Spikes in requests or unexpected API calls could indicate a compromised key or malicious activity.
• Never Expose Keys in Client-Side Code: Do not embed API keys directly into public client-side code (e.g., JavaScript in a web browser, mobile application bundles). This makes the key accessible to anyone inspecting your code and can lead to immediate compromise. All API calls requiring authentication should originate from a secure backend server.
• Secure Your Development Environment: Ensure that your development machines and environments are secure. Use strong passwords, keep software updated, and employ firewalls to protect sensitive credentials during development and testing.

By adhering to these security guidelines, developers can significantly reduce the risk of unauthorized access and ensure the integrity of their Clico API integrations.