Authenticate API v2 requests

Every public API v2 endpoint requires two headers:

http

Authorization: Bearer YOUR_API_KEY
X-Clan-Id: COMMUNITY_ID

YOUR_API_KEY is the one-time cl_live_… secret. COMMUNITY_ID is the Clan ID shown separately on the API settings page. A key is bound to one community; pairing it with another Clan ID does not grant cross-community access.

Roblox Creator OAuth authorizes Clan Labs to perform community operations separately from these headers. Continue sending your cl_live_ key and X-Clan-Id; do not send a Roblox OAuth token to the public API. If a Roblox-backed operation requires reconnection, the Super Owner must restore it in Settings → Roblox Cloud.

Request requirements

For authentication to pass, all of these must be true:

The URL uses https://api.clanlabs.co/v2/....
Both headers are present and correctly formatted.
The API master switch is enabled for the community.
The individual key exists and is enabled.
The key has the endpoint’s required scope.
The community has an active subscription with API access and the endpoint’s feature.

Status and code	Meaning	Next action
`401 missing_credentials`	A key or `X-Clan-Id` is absent.	Add both headers.
`401 unauthorized`	The key shape, secret, or community could not be authenticated.	Check the host, Clan ID, key prefix, and secret-manager value, including extra whitespace or a stale rotated key.
`403 api_disabled`	The community API master switch is off.	Enable it in API settings.
`403 key_disabled`	This key is disabled.	Enable it or use a current key.
`403 legacy_key_unsupported`	A migrated legacy key was sent to `/v2`.	Rotate it in Settings → API Keys to issue a `cl_live_` key.
`403 insufficient_scope`	The key lacks the operation’s permission.	Add only the required scope; read `WWW-Authenticate` for its name.
`403 entitlement_required`	The subscription is not active.	Restore the community subscription.
`403 api_access_unavailable`	The plan does not include any API access.	Compare the available plans.
`403 feature_unavailable`	The endpoint’s product feature is unavailable.	Check tier, trial, and feature details.

Authenticate API v2 requests

Request requirements

Authentication failures

Server-side storage

Retry or get help

Example request

Request requirementsCopy link to Request requirements

Authentication failuresCopy link to Authentication failures

Server-side storageCopy link to Server-side storage

Retry or get helpCopy link to Retry or get help

Example requestCopy link to Example request

Request requirements

Authentication failures

Server-side storage

Retry or get help

Example request