Auth and billing

The hosted API is the product, and it needs an account and an API key. (Local render with npx kove render asks for no account and no card, so you can try kove before signing up.) The account is the auth a developer expects: normal login, recoverable key, upgrade in the browser.

The account (Clerk)

Identity is handled by Clerk. When you run kove login, the hosted Clerk login opens and you pick a method: GitHub, Google, or email (OTP). We do not choose for you; Clerk presents the options.

What this gives you:

• A real, recoverable account. You are a real user. Lost your API key? Sign in again and a new one is issued. There is no password for us to manage or for you to lose.
• Verified identity out of the box (GitHub / Google / verified email), with Clerk anti-bot at signup.

We only store the business side: your plan, your usage, and your stripe_customer_id. Tokens and login are handled by Clerk.

API keys

The API key is what you use as Authorization: Bearer against the API. It is created programmatically after login.

Get one

npx kove login

Device-flow: the browser opens, you sign in, and the key comes back on its own to the terminal (~/.kove/credentials.json). You copy nothing. Flow details in CLI · login.

Manage them

npx kove keys list          # lists (id and name)
npx kove keys revoke <id>   # revokes a key

Or via the API: POST /v1/keys (issue), GET /v1/keys (list metadata), DELETE /v1/keys/:id (revoke).

The secret is shown only once

The full key is shown only when you create it. After that you see only metadata (id, name, last used). Keep it safe; if you lose it, issue another with kove login and revoke the old one.

Free tier

The free plan is perpetual: 100 documents per month, no card. Enough to integrate, test, and run small projects. Check your usage whenever you want:

curl https://api.kove.dev/v1/account -H "Authorization: Bearer $KOVE_API_KEY"
# { "plan": "free", "usage": 12, "limit": 100, "remaining": 88 }

Or with the MCP, the account_status tool. When you run out of quota, renders return 429 until the next period (or until you upgrade).

Upgrade to Pro

Billing is Stripe Checkout. Upgrading opens the browser to pay; the plan activates automatically after payment (via a Stripe webhook).

Via the API:

curl -X POST https://api.kove.dev/v1/checkout \
  -H "Authorization: Bearer $KOVE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "plan": "pro" }'
# { "checkout_url": "https://checkout.stripe.com/c/pay/..." }

Open that checkout_url in the browser and pay. From an agent, the upgrade tool in the MCP does this and opens the browser for you. You do not wait: the plan activates on its own once Stripe confirms the payment.

Summary

I want to…	I run…
Try it without an account	npx kove render doc.json -o doc.pdf
Get an API key	npx kove login (comes back on its own)
Check my usage	GET /v1/account or the account_status tool
Upgrade to Pro	POST /v1/checkout or the upgrade tool
Rotate/recover a key	npx kove login again + kove keys revoke