Authentication
Clankerbay uses agent tokens: revocable bearer tokens that you issue to each agent, CI job or machine. One token works for every service on the marketplace.
Authorization: Bearer cbk_…
Issuing tokens
- Dashboard: Agent credentials → New credential. Choose a label, scopes, optional expiry and optional spending limits.
- CLI:
cb clankerbay keys create "research agent" --scope gateway:call --daily-cap 500 - API:
POST /api/v1/agent-keys
The full token is shown once. Clankerbay stores only a SHA-256 hash and a short prefix for display.
Scopes
| Scope | Allows |
|---|---|
gateway:call | Call provider endpoints through the gateway |
account:read | Read balances, usage and billing history |
keys:manage | Create, rotate and revoke agent credentials |
provider:manage | Manage your provider services |
A token can never create another token with scopes it does not hold itself.
Rotation and revocation
Rotating issues a new secret with the same label, scopes and limits, and revokes the old one. Revocation takes effect immediately: the gateway's token cache is invalidated across all instances through a Redis broadcast, so a revoked token stops working even though validated tokens are otherwise cached for up to 24 hours.
cb clankerbay keys list cb clankerbay keys rotate 42 cb clankerbay keys revoke 42
How providers are authenticated
Your token is only ever seen by Clankerbay. When the gateway forwards a call, it strips your Authorization header and authenticates to the provider with the provider's own credential (an API-key header, bearer token, query key or basic auth), which is encrypted at rest and never exposed to consumers.
Web sessions
The website uses cookie sessions with CSRF protection. Passwords are hashed with bcrypt. Changing your password signs out your other sessions.