Get started
Cladior sits between your users and your API. It handles auth, billing, and access control. You configure it in the dashboard. Your backend doesn't change.
Set up your app
Sign in to the developer dashboard and register an app. The wizard saves a draft as you go, so you can leave and come back.
- API URL: the base URL Cladior forwards traffic to, e.g.
https://origin.yourapp.com. Your users never call this directly, so you can move hosts later without breaking anything. - Rate per kilobyte: what a user pays per kilobyte of response data. Cladior takes 20%; the rest is your earnings.
- Name, tagline and description: shown to users on the connect screen and in Explore.
- Category and keywords: where your app appears in Explore, and what it matches on search.
- Permissions: which user data your app may access. Users see these on the consent screen and can deny them individually, so ask only for what you need (see Scopes).
Publishing gives you an App ID and your API address -
a cladior.com URL you hand to your users. Every path on it
forwards to your API automatically. You'll use both in the next two steps.
api.yourapp.com), it cannot be the same host your API
answers on - Cladior would forward the request straight back to itself. Keeping your origin
on something like origin.yourapp.com leaves api.yourapp.com free for the public address.Add the SDK
Drop one script tag into any HTML page where users will access your API.
Set data-cladior-site to the App ID from your dashboard.
<script
src="https://www.cladior.com/sdk/v2.js"
data-cladior-site="your-app-id"
></script>The SDK initialises automatically. It intercepts your API calls, shows the connect popup when needed, and handles wallet prompts. You don't write any auth or billing code.
Route calls through the proxy
Take the proxy base URL from your dashboard and use it as the prefix for your API calls. Your backend receives the request exactly as before. Cladior bills the user first, then forwards.
fetch('https://api.yourapp.com/generate')fetch('https://cladior.com/p/your-token/generate')All paths forward automatically. Your backend code doesn't change. Users who aren't connected see Cladior's connect popup. Users with an empty wallet see a top-up prompt. Your code only ever sees the success case.
api.yourdomain.com → cladior.com and enter the subdomain in the dashboard under Custom Domain.
Once active, your users call api.yourdomain.com directly,
with no proxy URL prefix needed in your code. The SDK auto-detects the custom domain.Optional: personalise after connect
When a user connects, the SDK fires pass:connected on window. Use it to apply their preferred theme or show their avatar.
window.addEventListener('pass:connected', async () => {
const info = await cladiorPass.getUserInfo();
if (info.theme) document.documentElement.dataset.theme = info.theme;
if (info.avatar_url) document.getElementById('avatar').src = info.avatar_url;
});This is optional. The proxy, billing, and connect flow all work without it.
Lock your API to Cladior
Do this one. Without it your API is still reachable directly, and a direct call skips billing entirely.
Routing traffic through Cladior does not hide your API. Anyone who sees a proxied response can go looking for the origin, and subdomains are not secret: every hostname that gets a TLS certificate is published to public Certificate Transparency logs and is searchable. Using your own domain does not change this - the origin behind it is just as findable.
So every request we forward carries your app's secret, which you'll find under Integration → Origin secret in the dashboard:
X-Cladior-Secret: 8f2c… (the value from your dashboard)Reject anything that arrives without it. In Express:
app.use((req, res, next) => {
if (req.get('x-cladior-secret') !== process.env.CLADIOR_SECRET) {
return res.status(403).json({ error: 'Direct access not allowed' });
}
next();
});