# Authentication

> Source: https://docs.clonepartner.com/api-reference/authentication/

Each endpoint page shows its effective security requirements. Operation-level requirements override the API-wide requirements.

## BearerAuth

- **Type:** `http bearer`
- **Description:** API key token. Create via POST /api/api-keys. Format: `envoy_<hex>`
- **HTTP scheme:** `bearer`

## CookieAuth

- **Type:** `apiKey`
- **Description:** Session cookie set after login + TOTP verification
- **Location:** `cookie`
- **Name:** `envoy_session`

## ExecutorKeyAuth

- **Type:** `http bearer`
- **Description:** Shared executor secret (`ENVOY_EXECUTOR_KEY`). Used by internal executor-to-control-plane routes (registration, heartbeat, completion/log callbacks).
- **HTTP scheme:** `bearer`
- **Usage:** Internal executor-to-control-plane requests only. Preserve this scheme on executor endpoints.

## API-wide requirement

### Option 1

- **BearerAuth** (`http bearer`)
  API key token. Create via POST /api/api-keys. Format: `envoy_<hex>`

### Option 2

- **CookieAuth** (`apiKey`)
  Session cookie set after login + TOTP verification

An endpoint with an explicit empty `security` array is unauthenticated, even when the API defines an API-wide requirement.