Microsoft Clarity Authentication

generated: '2026-08-13'
method: searched
source: https://learn.microsoft.com/en-us/clarity/setup-and-installation/clarity-data-export-api
docs: https://learn.microsoft.com/en-us/clarity/setup-and-installation/clarity-data-export-api#authentication
derived_from: openapi/microsoft-clarity-dataexport-api-openapi.yml
summary:
  types:
    - http
  oauth2: false
  api_key: false
  mtls: false
  note: >-
    One credential type covers the whole HTTP surface: a project-scoped JWT
    bearer token issued from the Clarity dashboard. There is no OAuth flow, no
    key/secret pair, no client registration and no scopes.
schemes:
  - name: bearer_token
    type: http
    scheme: bearer
    bearerFormat: JWT
    description: >-
      API access token generated by the project admin from the Clarity settings
      page.
    header: Authorization
    header_format: 'Bearer <Your_API_Token>'
    scope: project
    issuer_role: project admin only
    sources:
      - openapi/microsoft-clarity-dataexport-api-openapi.yml
      - https://learn.microsoft.com/en-us/clarity/setup-and-installation/clarity-data-export-api
    obtain:
      steps:
        - Go to your Clarity project.
        - Select Settings -> Data Export -> Generate new API token.
        - Provide a descriptive name for the token.
        - Copy and save the generated token securely.
      constraints:
        token_name_min_length: 4
        token_name_max_length: 32
        token_name_allowed: 'A-Z a-z 0-9 and - _ .'
        token_name_disallowed: 'spaces and @ # $ % & * !'
        token_name_unique_within_project: true
    rotation:
      automatic_expiry_published: false
      guidance: >-
        Clarity's published best practice is to promptly replace API tokens if a
        user with access is removed from the project, and to protect and
        securely store tokens.
    failure_modes:
      - status: 401
        cause: Missing, invalid, or expired token
      - status: 403
        cause: Token not authorized for operation
client_api_credential:
  note: >-
    Separate from the HTTP API. For the in-page client API Clarity states "Your
    Clarity ID serves as your API key. No other client API key is necessary, and
    there is no cost for using Clarity client APIs."
  docs: https://learn.microsoft.com/en-us/clarity/setup-and-installation/clarity-api
mcp_credential:
  note: >-
    The first-party MCP server reuses the same Data Export API token, passed as
    --clarity_api_token on the command line or as a tool parameter.
  see: mcp/microsoft-clarity-mcp.yml
oauth:
  present: false
  discovery_probe:
    - url: https://www.clarity.ms/.well-known/oauth-authorization-server
      status: 404
    - url: https://www.clarity.ms/.well-known/openid-configuration
      status: 404
  note: >-
    Probed 2026-08-13. No authorization server metadata is published, so
    scopes/microsoft-clarity-scopes.yml is intentionally absent.
maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com