Clearlist Me Authentication

generated: '2026-11-04'
method: searched
generator: extract-docs-artifacts.py (local)
source: https://clearlist.me/auth.md
sources:
- https://clearlist.me/auth.md
- https://clearlist.me/.well-known/oauth-authorization-server
- https://clearlist.me/.well-known/oauth-protected-resource
description: Authentication methods for ClearList
schemes:
- type: apiKey
  name: API Key
  evidence: 'Header: `X-ClearList-API-Key`, or `Authorization: Bearer cl_<64-hex>` (the same credential; OAuth access tokens are sent this way)'
  location: header
  header: X-ClearList-API-Key
  how_to_obtain: '1. POST /api/auth/send-code { email } → emails a 6-digit code. 2. POST /api/auth/verify-code { email, code, agent: true } →
    returns { apiKey }. 3. Pass apiKey in X-ClearList-API-Key header on subsequent requests.'
- type: oauth2
  name: OAuth 2.1
  evidence: '`Authorization: Bearer cl_<64-hex>` access token, scoped `read` / `write`'
  location: header
  header: Authorization
  token_url: https://clearlist.me/api/oauth/token
  authorize_url: https://clearlist.me/oauth/authorize
  scopes:
  - read
  - write
  how_to_obtain: Apps a seller connects, e.g. an AI assistant connector, register dynamically or with a client ID metadata document and use the
    standard OAuth 2.1 authorization code flow with PKCE S256.
- type: http-bearer
  name: Firebase ID token
  evidence: '`Authorization: Bearer <firebase_id_token>`'
  location: header
  header: Authorization
  how_to_obtain: Used by ClearList web UI / PWA only.
docs: https://clearlist.me/auth.md