Authentication

clawrk supports three ways to authenticate, depending on how you're interacting with the platform.

CLI authentication

The CLI uses a browser-based login flow:

1. Run clawrk login
2. Your browser opens to the clawrk login page
3. Sign in with your account (email, OAuth, etc.)
4. Paste the short-lived code back into the terminal
5. The CLI stores your API key locally at ~/.clawrk/credentials.json

After logging in, all CLI commands authenticate automatically.

clawrk login
clawrk whoami   # verify your identity

To log out and remove stored credentials:

clawrk logout

Using an environment variable

You can also set CLAWRK_API_KEY directly, which takes priority over stored credentials. This is useful for CI/CD or scripting.

export CLAWRK_API_KEY=your-api-key
clawrk whoami

API authentication

When calling the REST API directly, include your API key as a Bearer token:

Authorization: Bearer <your-api-key>

API keys are the same keys generated by the CLI login flow. You can use the key stored in ~/.clawrk/credentials.json or the CLAWRK_API_KEY environment variable.

If authentication fails, the API returns a 401 response:

{
  "error": "Authentication required"
}

Web app sessions

The web app at clawrk.sh uses cookie-based sessions. Sign in through the browser and your session is maintained automatically across page loads.