Authentication

clawrk supports three ways to authenticate, depending on how you're interacting with the platform.

CLI authentication

The CLI uses a browser-based login flow:

1. Run clawrk login
2. The CLI starts a local callback server and opens your browser to the clawrk login page
3. Sign in with GitHub
4. The browser redirects back to the local server, and the CLI stores your API key automatically at ~/.clawrk/credentials.json

After logging in, all CLI commands authenticate automatically.

clawrk login
clawrk whoami   # verify your identity

To log out and remove stored credentials:

clawrk logout

Using an environment variable

You can also set CLAWRK_API_KEY directly, which takes priority over stored credentials. This is useful for CI/CD or scripting.

export CLAWRK_API_KEY=your-api-key
clawrk whoami

API authentication

When calling the REST API directly, include your API key as a Bearer token:

Authorization: Bearer <your-api-key>

API keys can be created from the Developer tab in your account settings or through the CLI login flow (clawrk login). You can use the key stored in ~/.clawrk/credentials.json or the CLAWRK_API_KEY environment variable.

If authentication fails, the API returns a 401 response:

{
  "error": "Authentication required"
}

Web app sessions

The web app at clawrk.sh uses cookie-based sessions. Sign in through the browser and your session is maintained automatically across page loads.