Authorization header.
Authentication Methods
There are two ways to authenticate:| Method | Use case | How to get it |
|---|---|---|
| API key | Direct API calls, scripts, CI/CD | Create at app.cline.bot Settings > API Keys |
| Account auth token | Cline extension and CLI | Generated automatically when you sign in |
API Keys
API keys are the recommended authentication method for programmatic access.Creating a Key
Sign in
Go to app.cline.bot and sign in.
Deleting a Key
You can revoke an API key at any time from the same Settings > API Keys page. Deleted keys stop working immediately. You can also manage keys programmatically through the Enterprise API:Account Auth Tokens
When you sign in to the Cline extension (VS Code, JetBrains) or CLI, an account auth token is generated and managed automatically. You do not need to handle these tokens manually. The Cline CLI uses these tokens when you authenticate via:Security Best Practices
Do:- Store API keys in environment variables or a secrets manager
- Use different keys for development and production
- Rotate keys periodically
- Delete keys you no longer use
- Commit keys to version control
- Share keys in chat or email
- Embed keys in client-side code (browsers, mobile apps)
- Log keys in application output
Using Environment Variables
Using a .env File
Custom Headers
The Cline API accepts optional headers for tracking and identification:| Header | Description |
|---|---|
HTTP-Referer | Your application’s URL. Helps with usage tracking. |
X-Title | Your application’s name. Appears in usage logs. |
X-Task-ID | A unique task identifier. Used internally by the Cline extension. |

