diff --git a/.env.example b/.env.example
index c32ad3b..18e35e0 100644
--- a/.env.example
+++ b/.env.example
@@ -54,6 +54,21 @@ CREDIT_PACK_STARTER_CHECKOUT_URL=
 CREDIT_PACK_PRO_CHECKOUT_URL=
 CREDIT_PACK_RENDER_CHECKOUT_URL=
 
+# Talocode Cloud API key (primary — replaces CLIPLOOP_API_KEY)
+TALOCODE_API_KEY=
+# Talocode Cloud API base URL
+TALOCODE_BASE_URL=https://api.talocode.site
+
+# Legacy ClipLoop API key (deprecated — use TALOCODE_API_KEY instead)
+CLIPLOOP_API_KEY=
+
+# ClipLoop cloud engine providers (optional; not required for tests)
+CLIPLOOP_PROVIDER=
+CLIPLOOP_RENDER_PROVIDER=
+REMOTION_RENDER_ENABLED=false
+STORAGE_BUCKET=
+STORAGE_PUBLIC_URL=
+
 # Gateway split scaffolding (local defaults; no public gateway enabled yet)
 CLIPLOOP_GATEWAY_ENABLED=false
 CLIPLOOP_GATEWAY_MODE=local_app
diff --git a/README.md b/README.md
index cc89ff4..afbcc47 100644
--- a/README.md
+++ b/README.md
@@ -632,6 +632,17 @@ LEMON_SQUEEZY_WEBHOOK_SECRET=
 - The app uses Lemon Squeezy hosted checkout and customer-portal links rather than a custom in-app billing portal.
 - Real auth is still minimal, so in non-mock environments the checkout launcher relies on the email entered at checkout start to create or match the account record.
 
+## Talocode Domains
+
+| Domain | Purpose |
+|--------|---------|
+| [talocode.site](https://talocode.site) | Main site / homepage |
+| [docs.talocode.site](https://docs.talocode.site) | Documentation |
+| [api.talocode.site](https://api.talocode.site) | API endpoint |
+| [cloud.talocode.site](https://cloud.talocode.site) | Cloud dashboard |
+| [stacklane.talocode.site](https://stacklane.talocode.site) | Stacklane platform |
+| [dashboard.talocode.site](https://dashboard.talocode.site) | Dashboard |
+
 ## Developer docs site
 
 The ClipLoop developer documentation lives in `docs-site/` and is served at https://docs.cliploop.site.
diff --git a/app/api/v1/cliploop/brief/generate/route.ts b/app/api/v1/cliploop/brief/generate/route.ts
new file mode 100644
index 0000000..2b83822
--- /dev/null
+++ b/app/api/v1/cliploop/brief/generate/route.ts
@@ -0,0 +1,21 @@
+import { handleRoute } from '@/lib/talocode-route-handler'
+
+export async function POST(request: Request): Promise<Response> {
+  return handleRoute(
+    request,
+    { action: 'brief.generate', credits: 15 },
+    async () => {
+      const body = await request.json().catch(() => ({}))
+      // TODO: implement full brief generation flow
+      return Response.json({
+        ok: true,
+        data: {
+          id: `brief_${Date.now()}`,
+          brief: body.prompt ?? '',
+          channel: body.channel ?? 'twitter',
+          estimatedDuration: 15,
+        },
+      })
+    },
+  )
+}
diff --git a/app/api/v1/cliploop/campaign/create/route.ts b/app/api/v1/cliploop/campaign/create/route.ts
new file mode 100644
index 0000000..94f6c0a
--- /dev/null
+++ b/app/api/v1/cliploop/campaign/create/route.ts
@@ -0,0 +1,21 @@
+import { handleRoute } from '@/lib/talocode-route-handler'
+
+export async function POST(request: Request): Promise<Response> {
+  return handleRoute(
+    request,
+    { action: 'campaign.create', credits: 50 },
+    async () => {
+      const body = await request.json().catch(() => ({}))
+      // TODO: implement campaign creation
+      return Response.json({
+        ok: true,
+        data: {
+          id: `camp_${Date.now()}`,
+          name: body.name ?? 'Untitled Campaign',
+          status: 'draft',
+          videos: [],
+        },
+      })
+    },
+  )
+}
diff --git a/app/api/v1/cliploop/campaign/package/route.ts b/app/api/v1/cliploop/campaign/package/route.ts
new file mode 100644
index 0000000..00d8fd7
--- /dev/null
+++ b/app/api/v1/cliploop/campaign/package/route.ts
@@ -0,0 +1,21 @@
+import { handleRoute } from '@/lib/talocode-route-handler'
+
+export async function POST(request: Request): Promise<Response> {
+  return handleRoute(
+    request,
+    { action: 'campaign.package', credits: 400 },
+    async () => {
+      const body = await request.json().catch(() => ({}))
+      // TODO: implement full campaign packaging
+      return Response.json({
+        ok: true,
+        data: {
+          id: body.campaignId ?? `camp_${Date.now()}`,
+          name: 'Packaged Campaign',
+          status: 'packaged',
+          videos: [],
+        },
+      })
+    },
+  )
+}
diff --git a/app/api/v1/cliploop/health/route.ts b/app/api/v1/cliploop/health/route.ts
new file mode 100644
index 0000000..5a69eda
--- /dev/null
+++ b/app/api/v1/cliploop/health/route.ts
@@ -0,0 +1,14 @@
+export async function GET(): Promise<Response> {
+  return Response.json({
+    status: 'ok',
+    service: 'cliploop',
+    endpoints: [
+      'POST /v1/cliploop/brief/generate',
+      'POST /v1/cliploop/script/generate',
+      'POST /v1/cliploop/video/render',
+      'POST /v1/cliploop/campaign/create',
+      'POST /v1/cliploop/campaign/package',
+      'GET /v1/cliploop/health',
+    ],
+  })
+}
diff --git a/app/api/v1/cliploop/script/generate/route.ts b/app/api/v1/cliploop/script/generate/route.ts
new file mode 100644
index 0000000..5307335
--- /dev/null
+++ b/app/api/v1/cliploop/script/generate/route.ts
@@ -0,0 +1,22 @@
+import { handleRoute } from '@/lib/talocode-route-handler'
+
+export async function POST(request: Request): Promise<Response> {
+  return handleRoute(
+    request,
+    { action: 'script.generate', credits: 15 },
+    async () => {
+      const body = await request.json().catch(() => ({}))
+      // TODO: implement full script generation
+      return Response.json({
+        ok: true,
+        data: {
+          id: `script_${Date.now()}`,
+          script: 'Generated script based on brief.',
+          scenes: [
+            { index: 0, visual: 'Intro scene', narration: 'Opening narration', duration: 5 },
+          ],
+        },
+      })
+    },
+  )
+}
diff --git a/app/api/v1/cliploop/video/render/route.ts b/app/api/v1/cliploop/video/render/route.ts
new file mode 100644
index 0000000..b640cd8
--- /dev/null
+++ b/app/api/v1/cliploop/video/render/route.ts
@@ -0,0 +1,21 @@
+import { handleRoute } from '@/lib/talocode-route-handler'
+
+export async function POST(request: Request): Promise<Response> {
+  return handleRoute(
+    request,
+    { action: 'video.render', credits: 200 },
+    async () => {
+      const body = await request.json().catch(() => ({}))
+      // TODO: implement full render pipeline
+      return Response.json({
+        ok: true,
+        data: {
+          id: `render_${Date.now()}`,
+          status: 'rendering' as const,
+          duration: 30,
+          creditsCharged: 200,
+        },
+      })
+    },
+  )
+}
diff --git a/docs-site/cli/index.html b/docs-site/cli/index.html
index 51cc5da..7a734db 100644
--- a/docs-site/cli/index.html
+++ b/docs-site/cli/index.html
@@ -57,7 +57,8 @@ <h2 id="planned-commands">Planned commands</h2>
 <li><code>cliploop download</code></li>
 </ul>
 <h2 id="server-and-ci">Server and CI usage</h2>
-<p>For automation, set <code>CLIPLOOP_API_KEY</code> in your environment instead of interactive login. This works for backend jobs, CI pipelines, and short release workflows.</p>
+<p>For automation, set <code>TALOCODE_API_KEY</code> in your environment instead of interactive login. This works for backend jobs, CI pipelines, and short release workflows.</p>
+<p><strong>Deprecation note:</strong> <code>CLIPLOOP_API_KEY</code> is deprecated. Use <code>TALOCODE_API_KEY</code> for all hosted ClipLoop API access.</p>
 <h2 id="useful-for">Useful for</h2>
 <ul>
 <li>Indie builders iterating in terminals.</li>
diff --git a/docs-site/dist/cli/index.html b/docs-site/dist/cli/index.html
index 51cc5da..7a734db 100644
--- a/docs-site/dist/cli/index.html
+++ b/docs-site/dist/cli/index.html
@@ -57,7 +57,8 @@ <h2 id="planned-commands">Planned commands</h2>
 <li><code>cliploop download</code></li>
 </ul>
 <h2 id="server-and-ci">Server and CI usage</h2>
-<p>For automation, set <code>CLIPLOOP_API_KEY</code> in your environment instead of interactive login. This works for backend jobs, CI pipelines, and short release workflows.</p>
+<p>For automation, set <code>TALOCODE_API_KEY</code> in your environment instead of interactive login. This works for backend jobs, CI pipelines, and short release workflows.</p>
+<p><strong>Deprecation note:</strong> <code>CLIPLOOP_API_KEY</code> is deprecated. Use <code>TALOCODE_API_KEY</code> for all hosted ClipLoop API access.</p>
 <h2 id="useful-for">Useful for</h2>
 <ul>
 <li>Indie builders iterating in terminals.</li>
diff --git a/docs-site/dist/examples/index.html b/docs-site/dist/examples/index.html
index 8231406..a4a6b24 100644
--- a/docs-site/dist/examples/index.html
+++ b/docs-site/dist/examples/index.html
@@ -1,52 +1,9 @@
-<!DOCTYPE html>
-<html lang="en">
-<head>
-<meta charset="UTF-8">
-<meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=yes">
-<title>Examples · ClipLoop Developer Docs</title>
-<link rel="stylesheet" href="/styles.css">
-</head>
-<body>
-<a href="#content" class="skip-link">Skip to content</a>
-<button class="mobile-toggle" aria-label="Open menu" onclick="document.getElementById('sidebar').classList.add('open');document.getElementById('overlay').classList.add('open')">☰</button>
-<div class="sidebar-overlay" id="overlay" onclick="document.getElementById('sidebar').classList.remove('open');document.getElementById('overlay').classList.remove('open')"></div>
-<nav class="sidebar" id="sidebar" aria-label="Docs navigation">
-  <div class="logo">
-    <div class="logo-mark">CL</div>
-    <div class="logo-text">ClipLoop<small>Developer Docs</small></div>
-  </div>
-  <div class="nav-section">
-    <div class="nav-section-title">Getting Started</div>
-    <a href="/overview/" class="nav-link ">Overview</a>
-    <a href="/quickstart/" class="nav-link ">Quickstart</a>
-    <a href="/authentication/" class="nav-link ">Authentication</a>
-    <a href="/idempotency/" class="nav-link ">Idempotency</a>
-    <a href="/credits/" class="nav-link ">Credits & Billing</a>
-  </div>
-  <div class="nav-divider"></div>
-  <div class="nav-section">
-    <div class="nav-section-title">API Reference</div>
-    <a href="/weekly-promo-api/" class="nav-link ">Weekly Promo API</a>
-    <a href="/examples/" class="nav-link active">Examples</a>
-    <a href="/errors/" class="nav-link ">Error Codes</a>
-  </div>
-  <div class="nav-divider"></div>
-  <div class="nav-section">
-    <div class="nav-section-title">More</div>
-    <a href="/roadmap/" class="nav-link ">Roadmap</a>
-    <a href="https://app.cliploop.site" class="nav-link">App Dashboard →</a>
-    <a href="https://cliploop.site" class="nav-link">Marketing Site →</a>
-  </div>
-</nav>
-<main class="main" id="content">
-  <div class="content">
-    
-    <h1>Examples</h1>
+<h1>Examples</h1>
 <p class="lead">Copy and adapt these examples to call the Weekly Promo API from your backend or scripts.</p>
 
 <h2 id="curl">cURL</h2>
 <div class="code-block"><code>curl -X POST https://app.cliploop.site/api/public/weekly-promo \
-  -H "Authorization: Bearer $CLIPLOOP_API_KEY" \
+  -H "Authorization: Bearer $TALOCODE_API_KEY" \
   -H "Idempotency-Key: $IDEMPOTENCY_KEY" \
   -H "Content-Type: application/json" \
   -d '{
@@ -63,7 +20,7 @@ <h2 id="javascript">JavaScript (fetch)</h2>
 <div class="code-block"><code>const response = await fetch("https://app.cliploop.site/api/public/weekly-promo", {
   method: "POST",
   headers: {
-    Authorization: `Bearer ${process.env.CLIPLOOP_API_KEY}`,
+    Authorization: `Bearer ${process.env.TALOCODE_API_KEY}`,
     "Idempotency-Key": `promo-${Date.now()}`,
     "Content-Type": "application/json"
   },
@@ -84,7 +41,7 @@ <h2 id="node">Node.js</h2>
 <div class="code-block"><code>const response = await fetch("https://app.cliploop.site/api/public/weekly-promo", {
   method: "POST",
   headers: {
-    Authorization: `Bearer ${process.env.CLIPLOOP_API_KEY}`,
+    Authorization: `Bearer ${process.env.TALOCODE_API_KEY}`,
     "Idempotency-Key": `promo-${Date.now()}`,
     "Content-Type": "application/json"
   },
@@ -102,27 +59,13 @@ <h2 id="node">Node.js</h2>
 if (!response.ok) throw new Error(data.error?.message || `HTTP ${response.status}`);</code></div>
 
 <h2 id="environment-variables">Environment variables</h2>
-<div class="code-block"><code>CLIPLOOP_API_KEY=clp_li...
+<div class="code-block"><code># Primary
+TALOCODE_API_KEY=tk_...
+TALOCODE_BASE_URL=https://api.talocode.site
+
+# Legacy (deprecated)
+# CLIPLOOP_API_KEY=clp_...
+
 IDEMPOTENCY_KEY=promo-2026-05-30-cliploop</code></div>
 <div class="callout">⚠️ Never commit real API keys to source control. Store them in environment variables or a secrets manager.</div>
-
-    <footer>
-      <p style="display:flex; flex-wrap:wrap; gap:14px; align-items:center; justify-content:space-between">
-        <span>© 2026 ClipLoop · Built by <a href="https://talocode.com" style="color:var(--text3)">Talocode</a></span>
-        <span style="display:flex; gap:14px">
-          <a href="https://cliploop.site">Marketing</a>
-          <a href="https://app.cliploop.site">Dashboard</a>
-          <a href="https://github.com/talocode/cliploop">GitHub</a>
-        </span>
-      </p>
-    </footer>
-  </div>
-</main>
-<script>
-document.getElementById('overlay').addEventListener('click', function(){
-  document.getElementById('sidebar').classList.remove('open');
-  this.classList.remove('open');
-});
-</script>
-</body>
-</html>
+<div class="callout">⚠️ <code>CLIPLOOP_API_KEY</code> is deprecated. Use <code>TALOCODE_API_KEY</code> for all hosted ClipLoop API access.</div>
diff --git a/docs-site/dist/sdks/index.html b/docs-site/dist/sdks/index.html
index 63bd1f3..d4b514b 100644
--- a/docs-site/dist/sdks/index.html
+++ b/docs-site/dist/sdks/index.html
@@ -54,14 +54,19 @@ <h2 id="official-typescript-sdk">Official TypeScript SDK</h2>
 <h2 id="installation">Installation</h2>
 <pre><code>npm install @cliploop/sdk</code></pre>
 <h2 id="usage">Usage</h2>
-<p class="callout"><span style="color:var(--accent)">Server-side only</span> Use this SDK from Node.js, backend jobs, or secure workers. Do not call it from browser apps that ship to end users, and never expose <code>CLIPLOOP_API_KEY</code> in frontend code.</p>
+<p class="callout"><span style="color:var(--accent)">Server-side only</span> Use this SDK from Node.js, backend jobs, or secure workers. Do not call it from browser apps that ship to end users, and never expose API keys in frontend code.</p>
 <p>Set your API key in your environment:</p>
-<pre><code>export CLIPLOOP_API_KEY="your-dashboard-api-key"</code></pre>
+<pre><code># Primary: use Talocode Cloud API key
+export TALOCODE_API_KEY="your-talocode-cloud-key"
+export TALOCODE_BASE_URL="https://api.talocode.site"
+
+# Legacy (deprecated — use TALOCODE_API_KEY instead)
+# export CLIPLOOP_API_KEY="your-dashboard-api-key"</code></pre>
 <p>Then call the client:</p>
 <pre><code>import { ClipLoopClient } from "@cliploop/sdk";
 
 const client = new ClipLoopClient({
-  apiKey: process.env.CLIPLOOP_API_KEY
+  apiKey: process.env.TALOCODE_API_KEY
 });
 
 const result = await client.generateWeeklyPromo({
diff --git a/docs-site/examples/index.html b/docs-site/examples/index.html
index 8424a74..a4a6b24 100644
--- a/docs-site/examples/index.html
+++ b/docs-site/examples/index.html
@@ -3,7 +3,7 @@ <h1>Examples</h1>
 
 <h2 id="curl">cURL</h2>
 <div class="code-block"><code>curl -X POST https://app.cliploop.site/api/public/weekly-promo \
-  -H "Authorization: Bearer $CLIPLOOP_API_KEY" \
+  -H "Authorization: Bearer $TALOCODE_API_KEY" \
   -H "Idempotency-Key: $IDEMPOTENCY_KEY" \
   -H "Content-Type: application/json" \
   -d '{
@@ -20,7 +20,7 @@ <h2 id="javascript">JavaScript (fetch)</h2>
 <div class="code-block"><code>const response = await fetch("https://app.cliploop.site/api/public/weekly-promo", {
   method: "POST",
   headers: {
-    Authorization: `Bearer ${process.env.CLIPLOOP_API_KEY}`,
+    Authorization: `Bearer ${process.env.TALOCODE_API_KEY}`,
     "Idempotency-Key": `promo-${Date.now()}`,
     "Content-Type": "application/json"
   },
@@ -41,7 +41,7 @@ <h2 id="node">Node.js</h2>
 <div class="code-block"><code>const response = await fetch("https://app.cliploop.site/api/public/weekly-promo", {
   method: "POST",
   headers: {
-    Authorization: `Bearer ${process.env.CLIPLOOP_API_KEY}`,
+    Authorization: `Bearer ${process.env.TALOCODE_API_KEY}`,
     "Idempotency-Key": `promo-${Date.now()}`,
     "Content-Type": "application/json"
   },
@@ -59,6 +59,13 @@ <h2 id="node">Node.js</h2>
 if (!response.ok) throw new Error(data.error?.message || `HTTP ${response.status}`);</code></div>
 
 <h2 id="environment-variables">Environment variables</h2>
-<div class="code-block"><code>CLIPLOOP_API_KEY=clp_li...
+<div class="code-block"><code># Primary
+TALOCODE_API_KEY=tk_...
+TALOCODE_BASE_URL=https://api.talocode.site
+
+# Legacy (deprecated)
+# CLIPLOOP_API_KEY=clp_...
+
 IDEMPOTENCY_KEY=promo-2026-05-30-cliploop</code></div>
 <div class="callout">⚠️ Never commit real API keys to source control. Store them in environment variables or a secrets manager.</div>
+<div class="callout">⚠️ <code>CLIPLOOP_API_KEY</code> is deprecated. Use <code>TALOCODE_API_KEY</code> for all hosted ClipLoop API access.</div>
diff --git a/docs-site/scripts/add-platform-pages.mjs b/docs-site/scripts/add-platform-pages.mjs
index 34e3fdd..fd5a20b 100644
--- a/docs-site/scripts/add-platform-pages.mjs
+++ b/docs-site/scripts/add-platform-pages.mjs
@@ -154,14 +154,18 @@ write('sdks', shell('SDKs', `<h1>SDKs</h1>
 <h2 id="installation">Installation</h2>
 <pre><code>npm install @cliploop/sdk</code></pre>
 <h2 id="usage">Usage</h2>
-<p class="callout"><span style="color:var(--accent)">Server-side only</span> Use this SDK from Node.js, backend jobs, or secure workers. Do not call it from browser apps that ship to end users, and never expose <code>CLIPLOOP_API_KEY</code> in frontend code.</p>
+<p class="callout"><span style="color:var(--accent)">Server-side only</span> Use this SDK from Node.js, backend jobs, or secure workers. Do not call it from browser apps that ship to end users, and never expose API keys in frontend code.</p>
 <p>Set your API key in your environment:</p>
-<pre><code>export CLIPLOOP_API_KEY="your-dashboard-api-key"</code></pre>
+<pre><code>export TALOCODE_API_KEY="your-talocode-cloud-key"
+export TALOCODE_BASE_URL="https://api.talocode.site"
+
+# Legacy (deprecated)
+# export CLIPLOOP_API_KEY="your-dashboard-api-key"</code></pre>
 <p>Then call the client:</p>
 <pre><code>import { ClipLoopClient } from "@cliploop/sdk";
 
 const client = new ClipLoopClient({
-  apiKey: process.env.CLIPLOOP_API_KEY
+  apiKey: process.env.TALOCODE_API_KEY
 });
 
 const result = await client.generateWeeklyPromo({
@@ -197,7 +201,8 @@ write('cli', shell('CLI', `<h1>CLI</h1>
 <li><code>cliploop download</code></li>
 </ul>
 <h2 id="server-and-ci">Server and CI usage</h2>
-<p>For automation, set <code>CLIPLOOP_API_KEY</code> in your environment instead of interactive login. This works for backend jobs, CI pipelines, and short release workflows.</p>
+<p>For automation, set <code>TALOCODE_API_KEY</code> in your environment instead of interactive login. This works for backend jobs, CI pipelines, and short release workflows.</p>
+<p><strong>Deprecation note:</strong> <code>CLIPLOOP_API_KEY</code> is deprecated. Use <code>TALOCODE_API_KEY</code> for all hosted ClipLoop API access.</p>
 <h2 id="useful-for">Useful for</h2>
 <ul>
 <li>Indie builders iterating in terminals.</li>
diff --git a/docs-site/sdks/index.html b/docs-site/sdks/index.html
index 63bd1f3..d4b514b 100644
--- a/docs-site/sdks/index.html
+++ b/docs-site/sdks/index.html
@@ -54,14 +54,19 @@ <h2 id="official-typescript-sdk">Official TypeScript SDK</h2>
 <h2 id="installation">Installation</h2>
 <pre><code>npm install @cliploop/sdk</code></pre>
 <h2 id="usage">Usage</h2>
-<p class="callout"><span style="color:var(--accent)">Server-side only</span> Use this SDK from Node.js, backend jobs, or secure workers. Do not call it from browser apps that ship to end users, and never expose <code>CLIPLOOP_API_KEY</code> in frontend code.</p>
+<p class="callout"><span style="color:var(--accent)">Server-side only</span> Use this SDK from Node.js, backend jobs, or secure workers. Do not call it from browser apps that ship to end users, and never expose API keys in frontend code.</p>
 <p>Set your API key in your environment:</p>
-<pre><code>export CLIPLOOP_API_KEY="your-dashboard-api-key"</code></pre>
+<pre><code># Primary: use Talocode Cloud API key
+export TALOCODE_API_KEY="your-talocode-cloud-key"
+export TALOCODE_BASE_URL="https://api.talocode.site"
+
+# Legacy (deprecated — use TALOCODE_API_KEY instead)
+# export CLIPLOOP_API_KEY="your-dashboard-api-key"</code></pre>
 <p>Then call the client:</p>
 <pre><code>import { ClipLoopClient } from "@cliploop/sdk";
 
 const client = new ClipLoopClient({
-  apiKey: process.env.CLIPLOOP_API_KEY
+  apiKey: process.env.TALOCODE_API_KEY
 });
 
 const result = await client.generateWeeklyPromo({
diff --git a/packages/cliploop-sdk/README.md b/packages/cliploop-sdk/README.md
index dbe55e2..96c9662 100644
--- a/packages/cliploop-sdk/README.md
+++ b/packages/cliploop-sdk/README.md
@@ -1,6 +1,6 @@
 # @cliploop/sdk
 
-> Local ClipLoop TypeScript SDK. `npm install @cliploop/sdk` is coming soon.
+> ClipLoop TypeScript SDK for server-side integration with Talocode Cloud.
 
 Use this SDK server-side only. Do not use it in browser apps that ship to end users.
 
@@ -10,15 +10,20 @@ Use this SDK server-side only. Do not use it in browser apps that ship to end us
 npm install @cliploop/sdk
 ```
 
-## Usage
-
-Set your API key in your environment.
+## Environment
 
 ```bash
-export CLIPLOOP_API_KEY="your-dashboard-key"
+# Primary (required for Talocode Cloud hosted API)
+export TALOCODE_API_KEY="your-talocode-cloud-key"
+export TALOCODE_BASE_URL="https://api.talocode.site"
+
+# Legacy (deprecated — use TALOCODE_API_KEY instead)
+# export CLIPLOOP_API_KEY="your-dashboard-key"
 ```
 
-Use the client from a server, backend job, or secure worker.
+## Usage
+
+### Generate a Weekly Promo (legacy app API)
 
 ```ts
 import { ClipLoopClient } from "@cliploop/sdk";
@@ -38,12 +43,48 @@ const result = await client.generateWeeklyPromo({
 console.log(result.downloadUrl);
 ```
 
+### Talocode Cloud hosted API
+
+```ts
+import { ClipLoopClient } from "@cliploop/sdk";
+
+const client = new ClipLoopClient();
+
+// Generate a brief
+const brief = await client.generateBrief({ prompt: "Weekly promo", channel: "twitter", tone: "professional" });
+console.log(brief.data.briefId);
+
+// Generate a script from a brief
+const script = await client.generateScript({ briefId: brief.data.briefId });
+console.log(script.data.scriptId);
+
+// Render a video from a script
+const render = await client.renderVideo({ scriptId: script.data.scriptId, format: "portrait" });
+console.log(render.data.renderId);
+
+// Create a campaign
+const campaign = await client.createCampaign({ name: "Q3 Promo", platform: "tiktok", schedule: "2026-07-15" });
+console.log(campaign.data.campaignId);
+
+// Package a campaign
+const packaged = await client.packageCampaign({ campaignId: campaign.data.campaignId });
+console.log(packaged.data.packageId);
+```
+
+## API Key Migration
+
+`CLIPLOOP_API_KEY` is **deprecated**. Use `TALOCODE_API_KEY` for all hosted ClipLoop API access via Talocode Cloud.
+
+The SDK reads `TALOCODE_API_KEY` first, falling back to `CLIPLOOP_API_KEY` only for backward compatibility. A deprecation warning is emitted when the legacy key is used.
+
 ## Security warning
 
-This SDK sends API keys to ClipLoop from the machine or process using it. Never call it from a browser bundle or public frontend. Keep keys on the server.
+This SDK sends API keys to Talocode Cloud from the machine or process using it. Never call it from a browser bundle or public frontend. Keep keys on the server.
 
 ## Related
 
+- Talocode Cloud: https://api.talocode.site
+- Talocode Cloud SDK: `@talocode/sdk` (available as `@stacklane/sdk`)
 - Developer docs: https://docs.cliploop.site/sdks/
 - Weekly Promo API: https://docs.cliploop.site/weekly-promo-api/
 - API keys: https://docs.cliploop.site/api-keys/
diff --git a/packages/cliploop-sdk/src/index.ts b/packages/cliploop-sdk/src/index.ts
index 45ebb8b..181ebfe 100644
--- a/packages/cliploop-sdk/src/index.ts
+++ b/packages/cliploop-sdk/src/index.ts
@@ -63,10 +63,22 @@ export class ClipLoopApiError extends Error {
 }
 
 const DEFAULT_BASE_URL = "https://app.cliploop.site";
+const TALOCODE_CLOUD_URL = "https://api.talocode.site";
 
 function envApiKey(): string | undefined {
   if (typeof process !== "undefined" && process?.env) {
-    return process.env.CLIPLOOP_API_KEY;
+    if (process.env.TALOCODE_API_KEY) {
+      return process.env.TALOCODE_API_KEY;
+    }
+    if (process.env.CLIPLOOP_API_KEY) {
+      if (typeof process.emitWarning === "function") {
+        process.emitWarning(
+          "CLIPLOOP_API_KEY is deprecated. Use TALOCODE_API_KEY for hosted ClipLoop API access.",
+          "DeprecationWarning"
+        );
+      }
+      return process.env.CLIPLOOP_API_KEY;
+    }
   }
   return undefined;
 }
@@ -74,13 +86,14 @@ function envApiKey(): string | undefined {
 export class ClipLoopClient {
   readonly apiKey: string;
   readonly baseURL: string;
+  readonly talocodeBaseURL: string;
 
   constructor(options: ClipLoopClientOptions = {}) {
     if (!options.apiKey) {
       const envKey = envApiKey();
       if (!envKey) {
         throw new Error(
-          "Missing API key. Pass apiKey or set CLIPLOOP_API_KEY."
+          "Missing API key. Pass apiKey or set TALOCODE_API_KEY (or legacy CLIPLOOP_API_KEY)."
         );
       }
       this.apiKey = envKey;
@@ -93,6 +106,10 @@ export class ClipLoopClient {
       DEFAULT_BASE_URL;
 
     this.baseURL = baseUrl.replace(/\/$/, "");
+    this.talocodeBaseURL =
+      (typeof process !== "undefined" &&
+        process.env?.TALOCODE_BASE_URL) ||
+      TALOCODE_CLOUD_URL;
   }
 
   async generateWeeklyPromo(
@@ -152,6 +169,149 @@ export class ClipLoopClient {
   }
 }
 
+  // ─── Talocode Cloud hosted API methods ──────────────────────────────
+
+  async generateBrief(
+    input: { prompt: string; channel?: string; tone?: string; duration?: number; cta?: string },
+    options: ClipLoopRequestOptions = {}
+  ): Promise<Record<string, unknown>> {
+    const idempotencyKey = options.idempotencyKey ?? `clp-sdk-${crypto.randomUUID()}`
+    const response = await fetch(
+      `${this.talocodeBaseURL}/v1/cliploop/brief/generate`,
+      {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          Authorization: `Bearer ${this.apiKey}`,
+          "Idempotency-Key": idempotencyKey,
+        },
+        body: JSON.stringify(input),
+      }
+    )
+    const data = await response.json()
+    if (!response.ok) {
+      throw new ClipLoopApiError({
+        message: `ClipLoop Cloud API error ${response.status}: ${data?.error?.message ?? "Request failed."}`,
+        status: response.status,
+        body: data,
+      })
+    }
+    return { ...data, idempotencyKey }
+  }
+
+  async generateScript(
+    input: { briefId: string; style?: string },
+    options: ClipLoopRequestOptions = {}
+  ): Promise<Record<string, unknown>> {
+    const idempotencyKey = options.idempotencyKey ?? `clp-sdk-${crypto.randomUUID()}`
+    const response = await fetch(
+      `${this.talocodeBaseURL}/v1/cliploop/script/generate`,
+      {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          Authorization: `Bearer ${this.apiKey}`,
+          "Idempotency-Key": idempotencyKey,
+        },
+        body: JSON.stringify(input),
+      }
+    )
+    const data = await response.json()
+    if (!response.ok) {
+      throw new ClipLoopApiError({
+        message: `ClipLoop Cloud API error ${response.status}: ${data?.error?.message ?? "Request failed."}`,
+        status: response.status,
+        body: data,
+      })
+    }
+    return { ...data, idempotencyKey }
+  }
+
+  async renderVideo(
+    input: { scriptId: string; format?: string; quality?: string },
+    options: ClipLoopRequestOptions = {}
+  ): Promise<Record<string, unknown>> {
+    const idempotencyKey = options.idempotencyKey ?? `clp-sdk-${crypto.randomUUID()}`
+    const response = await fetch(
+      `${this.talocodeBaseURL}/v1/cliploop/video/render`,
+      {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          Authorization: `Bearer ${this.apiKey}`,
+          "Idempotency-Key": idempotencyKey,
+        },
+        body: JSON.stringify(input),
+      }
+    )
+    const data = await response.json()
+    if (!response.ok) {
+      throw new ClipLoopApiError({
+        message: `ClipLoop Cloud API error ${response.status}: ${data?.error?.message ?? "Request failed."}`,
+        status: response.status,
+        body: data,
+      })
+    }
+    return { ...data, idempotencyKey }
+  }
+
+  async createCampaign(
+    input: { name: string; platform: string; schedule?: string },
+    options: ClipLoopRequestOptions = {}
+  ): Promise<Record<string, unknown>> {
+    const idempotencyKey = options.idempotencyKey ?? `clp-sdk-${crypto.randomUUID()}`
+    const response = await fetch(
+      `${this.talocodeBaseURL}/v1/cliploop/campaign/create`,
+      {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          Authorization: `Bearer ${this.apiKey}`,
+          "Idempotency-Key": idempotencyKey,
+        },
+        body: JSON.stringify(input),
+      }
+    )
+    const data = await response.json()
+    if (!response.ok) {
+      throw new ClipLoopApiError({
+        message: `ClipLoop Cloud API error ${response.status}: ${data?.error?.message ?? "Request failed."}`,
+        status: response.status,
+        body: data,
+      })
+    }
+    return { ...data, idempotencyKey }
+  }
+
+  async packageCampaign(
+    input: { campaignId: string },
+    options: ClipLoopRequestOptions = {}
+  ): Promise<Record<string, unknown>> {
+    const idempotencyKey = options.idempotencyKey ?? `clp-sdk-${crypto.randomUUID()}`
+    const response = await fetch(
+      `${this.talocodeBaseURL}/v1/cliploop/campaign/package`,
+      {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          Authorization: `Bearer ${this.apiKey}`,
+          "Idempotency-Key": idempotencyKey,
+        },
+        body: JSON.stringify(input),
+      }
+    )
+    const data = await response.json()
+    if (!response.ok) {
+      throw new ClipLoopApiError({
+        message: `ClipLoop Cloud API error ${response.status}: ${data?.error?.message ?? "Request failed."}`,
+        status: response.status,
+        body: data,
+      })
+    }
+    return { ...data, idempotencyKey }
+  }
+}
+
 function safeJsonParse(value: string) {
   try {
     return JSON.parse(value);
diff --git a/src/app/api/v1/cliploop/brief/generate/route.ts b/src/app/api/v1/cliploop/brief/generate/route.ts
new file mode 100644
index 0000000..f413e54
--- /dev/null
+++ b/src/app/api/v1/cliploop/brief/generate/route.ts
@@ -0,0 +1,37 @@
+import { handleRoute } from '@/lib/talocode-route-handler'
+import { generateBrief, briefInputSchema } from '@/lib/cliploop-cloud-engine'
+
+export const runtime = 'nodejs'
+
+export async function POST(request: Request) {
+  return handleRoute(
+    request,
+    { action: 'brief.generate', credits: 15 },
+    async () => {
+      const body = await request.json().catch(() => ({}))
+      const parsed = briefInputSchema.safeParse(body)
+      if (!parsed.success) {
+        return Response.json(
+          { ok: false, error: { code: 'validation_error', message: parsed.error.issues[0]?.message ?? 'Invalid input.' } },
+          { status: 400 },
+        )
+      }
+
+      const result = await generateBrief(parsed.data, {
+        requestId: `cliploop_req_${Date.now()}`,
+        keyType: 'talocode',
+        action: 'brief.generate',
+        credits: 15,
+        mode: 'hosted',
+        idempotencyKey: `idem_${Date.now()}`,
+      })
+
+      return Response.json({
+        id: `cliploop_req_${Date.now()}`,
+        object: 'cliploop.brief',
+        result,
+        usage: { credits: 15, action: 'cliploop.brief.generate' },
+      })
+    },
+  )
+}
diff --git a/src/app/api/v1/cliploop/campaign/create/route.ts b/src/app/api/v1/cliploop/campaign/create/route.ts
new file mode 100644
index 0000000..23396ee
--- /dev/null
+++ b/src/app/api/v1/cliploop/campaign/create/route.ts
@@ -0,0 +1,37 @@
+import { handleRoute } from '@/lib/talocode-route-handler'
+import { createCampaign, campaignCreateInputSchema } from '@/lib/cliploop-cloud-engine'
+
+export const runtime = 'nodejs'
+
+export async function POST(request: Request) {
+  return handleRoute(
+    request,
+    { action: 'campaign.create', credits: 50 },
+    async () => {
+      const body = await request.json().catch(() => ({}))
+      const parsed = campaignCreateInputSchema.safeParse(body)
+      if (!parsed.success) {
+        return Response.json(
+          { ok: false, error: { code: 'validation_error', message: parsed.error.issues[0]?.message ?? 'Invalid input.' } },
+          { status: 400 },
+        )
+      }
+
+      const result = await createCampaign(parsed.data, {
+        requestId: `cliploop_req_${Date.now()}`,
+        keyType: 'talocode',
+        action: 'campaign.create',
+        credits: 50,
+        mode: 'hosted',
+        idempotencyKey: `idem_${Date.now()}`,
+      })
+
+      return Response.json({
+        id: `cliploop_req_${Date.now()}`,
+        object: 'cliploop.campaign',
+        result,
+        usage: { credits: 50, action: 'cliploop.campaign.create' },
+      })
+    },
+  )
+}
diff --git a/src/app/api/v1/cliploop/campaign/package/route.ts b/src/app/api/v1/cliploop/campaign/package/route.ts
new file mode 100644
index 0000000..8063ceb
--- /dev/null
+++ b/src/app/api/v1/cliploop/campaign/package/route.ts
@@ -0,0 +1,37 @@
+import { handleRoute } from '@/lib/talocode-route-handler'
+import { packageCampaign, campaignPackageInputSchema } from '@/lib/cliploop-cloud-engine'
+
+export const runtime = 'nodejs'
+
+export async function POST(request: Request) {
+  return handleRoute(
+    request,
+    { action: 'campaign.package', credits: 400 },
+    async () => {
+      const body = await request.json().catch(() => ({}))
+      const parsed = campaignPackageInputSchema.safeParse(body)
+      if (!parsed.success) {
+        return Response.json(
+          { ok: false, error: { code: 'validation_error', message: parsed.error.issues[0]?.message ?? 'Invalid input.' } },
+          { status: 400 },
+        )
+      }
+
+      const result = await packageCampaign(parsed.data, {
+        requestId: `cliploop_req_${Date.now()}`,
+        keyType: 'talocode',
+        action: 'campaign.package',
+        credits: 400,
+        mode: 'hosted',
+        idempotencyKey: `idem_${Date.now()}`,
+      })
+
+      return Response.json({
+        id: `cliploop_req_${Date.now()}`,
+        object: 'cliploop.campaign_package',
+        result,
+        usage: { credits: 400, action: 'cliploop.campaign.package' },
+      })
+    },
+  )
+}
diff --git a/src/app/api/v1/cliploop/health/route.ts b/src/app/api/v1/cliploop/health/route.ts
new file mode 100644
index 0000000..6004772
--- /dev/null
+++ b/src/app/api/v1/cliploop/health/route.ts
@@ -0,0 +1,26 @@
+import { extractApiKeyFromRequest, validateApiKey } from '@/lib/talocode-auth'
+
+export const runtime = 'nodejs'
+
+export async function GET(request: Request) {
+  const apiKey = extractApiKeyFromRequest(request)
+  const auth = validateApiKey(apiKey)
+
+  if (!auth.valid) {
+    return Response.json(
+      { ok: false, error: { code: auth.reason === 'MISSING_API_KEY' ? 'missing_api_key' : 'invalid_api_key', message: 'Unauthorized.' } },
+      { status: 401 },
+    )
+  }
+
+  if (auth.keyType === 'cliploop_legacy') {
+    console.warn('[talocode-auth] CLIPLOOP_API_KEY is deprecated. Use TALOCODE_API_KEY for hosted ClipLoop API access.')
+  }
+
+  return Response.json({
+    ok: true,
+    service: 'cliploop',
+    status: 'healthy',
+    version: '0.1.0',
+  })
+}
diff --git a/src/app/api/v1/cliploop/script/generate/route.ts b/src/app/api/v1/cliploop/script/generate/route.ts
new file mode 100644
index 0000000..9266f97
--- /dev/null
+++ b/src/app/api/v1/cliploop/script/generate/route.ts
@@ -0,0 +1,37 @@
+import { handleRoute } from '@/lib/talocode-route-handler'
+import { generateScript, scriptInputSchema } from '@/lib/cliploop-cloud-engine'
+
+export const runtime = 'nodejs'
+
+export async function POST(request: Request) {
+  return handleRoute(
+    request,
+    { action: 'script.generate', credits: 15 },
+    async () => {
+      const body = await request.json().catch(() => ({}))
+      const parsed = scriptInputSchema.safeParse(body)
+      if (!parsed.success) {
+        return Response.json(
+          { ok: false, error: { code: 'validation_error', message: parsed.error.issues[0]?.message ?? 'Invalid input.' } },
+          { status: 400 },
+        )
+      }
+
+      const result = await generateScript(parsed.data, {
+        requestId: `cliploop_req_${Date.now()}`,
+        keyType: 'talocode',
+        action: 'script.generate',
+        credits: 15,
+        mode: 'hosted',
+        idempotencyKey: `idem_${Date.now()}`,
+      })
+
+      return Response.json({
+        id: `cliploop_req_${Date.now()}`,
+        object: 'cliploop.script',
+        result,
+        usage: { credits: 15, action: 'cliploop.script.generate' },
+      })
+    },
+  )
+}
diff --git a/src/app/api/v1/cliploop/video/render/route.ts b/src/app/api/v1/cliploop/video/render/route.ts
new file mode 100644
index 0000000..42a990d
--- /dev/null
+++ b/src/app/api/v1/cliploop/video/render/route.ts
@@ -0,0 +1,47 @@
+import { handleRoute } from '@/lib/talocode-route-handler'
+import { renderVideo, renderInputSchema } from '@/lib/cliploop-cloud-engine'
+
+export const runtime = 'nodejs'
+
+export async function POST(request: Request) {
+  return handleRoute(
+    request,
+    { action: 'video.render', credits: 200 },
+    async () => {
+      const body = await request.json().catch(() => ({}))
+      const parsed = renderInputSchema.safeParse(body)
+      if (!parsed.success) {
+        return Response.json(
+          { ok: false, error: { code: 'validation_error', message: parsed.error.issues[0]?.message ?? 'Invalid input.' } },
+          { status: 400 },
+        )
+      }
+
+      const result = await renderVideo(parsed.data, {
+        requestId: `cliploop_req_${Date.now()}`,
+        keyType: 'talocode',
+        action: 'video.render',
+        credits: 200,
+        mode: 'hosted',
+        idempotencyKey: `idem_${Date.now()}`,
+      })
+
+      if (result.status === 'provider_required') {
+        return Response.json({
+          id: `cliploop_req_${Date.now()}`,
+          object: 'cliploop.video_render',
+          result,
+          usage: { credits: 200, action: 'cliploop.video.render' },
+          warnings: [{ code: 'provider_required', message: result.message }],
+        })
+      }
+
+      return Response.json({
+        id: `cliploop_req_${Date.now()}`,
+        object: 'cliploop.video_render',
+        result,
+        usage: { credits: 200, action: 'cliploop.video.render' },
+      })
+    },
+  )
+}
diff --git a/src/gateway/config.ts b/src/gateway/config.ts
index 0e5f809..1ecb17c 100644
--- a/src/gateway/config.ts
+++ b/src/gateway/config.ts
@@ -7,10 +7,11 @@ export type GatewayConfig = {
 
 export function getGatewayConfig(): GatewayConfig {
   const mode = process.env.CLIPLOOP_GATEWAY_MODE === "hosted" ? "hosted" : "local_app";
+  const hasTalocodeKey = !!process.env.TALOCODE_API_KEY || !!process.env.CLIPLOOP_API_KEY;
   return {
-    enabled: process.env.CLIPLOOP_GATEWAY_ENABLED === "true",
+    enabled: process.env.CLIPLOOP_GATEWAY_ENABLED === "true" || mode === "hosted",
     mode,
-    requireApiKey: process.env.CLIPLOOP_GATEWAY_REQUIRE_API_KEY === "true",
+    requireApiKey: process.env.CLIPLOOP_GATEWAY_REQUIRE_API_KEY === "true" || (mode === "hosted" && hasTalocodeKey),
     defaultRateLimitPerMinute: Number(process.env.CLIPLOOP_GATEWAY_RATE_LIMIT_PER_MINUTE ?? 60),
   };
 }
diff --git a/src/lib/cliploop-cloud-engine.ts b/src/lib/cliploop-cloud-engine.ts
new file mode 100644
index 0000000..4a98931
--- /dev/null
+++ b/src/lib/cliploop-cloud-engine.ts
@@ -0,0 +1,213 @@
+import { z } from 'zod'
+import { generateStructuredObject } from '@/lib/llm'
+import { env } from '@/lib/env'
+
+// ─── Schemas ────────────────────────────────────────────────────────────
+
+export const briefInputSchema = z.object({
+  productName: z.string().min(1).max(200),
+  update: z.string().min(1).max(2000),
+  audience: z.string().max(500).optional(),
+  tone: z.string().max(100).optional(),
+  platform: z.string().max(50).optional(),
+})
+
+export const briefResultSchema = z.object({
+  title: z.string(),
+  angle: z.string(),
+  hook: z.string(),
+  keyPoints: z.array(z.string()).min(1).max(8),
+  cta: z.string(),
+})
+
+export const scriptInputSchema = z.object({
+  briefId: z.string().min(1),
+  style: z.string().max(100).optional(),
+})
+
+export const scriptResultSchema = z.object({
+  hook: z.string(),
+  script: z.string(),
+  scenes: z.array(z.object({
+    title: z.string(),
+    duration: z.number(),
+    description: z.string(),
+  })).default([]),
+  caption: z.string(),
+  hashtags: z.array(z.string()).default([]),
+})
+
+export const renderInputSchema = z.object({
+  scriptId: z.string().min(1),
+  format: z.enum(['portrait', 'landscape', 'square']).optional(),
+  quality: z.enum(['draft', 'standard', 'high']).optional(),
+})
+
+export const campaignCreateInputSchema = z.object({
+  name: z.string().min(1).max(200),
+  platform: z.string().min(1).max(50),
+  schedule: z.string().max(200).optional(),
+})
+
+export const campaignPackageInputSchema = z.object({
+  campaignId: z.string().min(1),
+})
+
+// ─── Context ────────────────────────────────────────────────────────────
+
+export interface EngineContext {
+  requestId: string
+  keyType: 'talocode' | 'cliploop_legacy'
+  action: string
+  credits: number
+  mode: 'hosted'
+  idempotencyKey: string
+}
+
+// ─── Engine Functions ──────────────────────────────────────────────────
+
+function isMockMode(): boolean {
+  const provider = process.env.LLM_PROVIDER ?? env.LLM_PROVIDER
+  const mockLlm = process.env.MOCK_LLM ?? String(env.MOCK_LLM)
+  return provider === 'mock' || mockLlm === 'true'
+}
+
+export async function generateBrief(
+  input: z.infer<typeof briefInputSchema>,
+  ctx: EngineContext,
+): Promise<z.infer<typeof briefResultSchema>> {
+  const mock = () => ({
+    title: `${input.productName}: ${input.update.slice(0, 60)}`,
+    angle: `We just shipped ${input.update.split('.')[0] || input.update.slice(0, 40)} and it changes everything for ${input.audience || 'our users'}.`,
+    hook: `Big news from ${input.productName}: ${input.update.slice(0, 80)}`,
+    keyPoints: [
+      input.update,
+      ...(input.audience ? [`Built for ${input.audience}`] : []),
+      `${input.productName} continues to ship at speed.`,
+    ].slice(0, 5),
+    cta: `Try ${input.productName} today.`,
+  })
+
+  if (isMockMode()) {
+    return briefResultSchema.parse(mock())
+  }
+
+  return generateStructuredObject({
+    schema: briefResultSchema,
+    mockFactory: mock,
+    prompt: [
+      'Generate a creative video brief for a product launch update.',
+      `Product: ${input.productName}`,
+      `Update: ${input.update}`,
+      ...(input.audience ? [`Target audience: ${input.audience}`] : []),
+      ...(input.tone ? [`Tone: ${input.tone}`] : []),
+      ...(input.platform ? [`Platform: ${input.platform}`] : []),
+      'Return: title, angle, hook, keyPoints (1-8 items), cta.',
+      'Keep the hook short and punchy.',
+    ].join('\n'),
+  })
+}
+
+export async function generateScript(
+  input: z.infer<typeof scriptInputSchema>,
+  ctx: EngineContext,
+): Promise<z.infer<typeof scriptResultSchema>> {
+  const mock = () => ({
+    hook: `Here's what's new.`,
+    script: `Scene 1: Open with the hook.\nScene 2: Explain what changed.\nScene 3: Show the benefit.\nScene 4: Call to action.`,
+    scenes: [
+      { title: 'Hook', duration: 3, description: 'Open with the hook line.' },
+      { title: 'Update', duration: 5, description: 'Explain what changed and why it matters.' },
+      { title: 'Benefit', duration: 4, description: 'Show the key benefit for the audience.' },
+      { title: 'CTA', duration: 3, description: 'Prompt viewers to take action.' },
+    ],
+    caption: `Check out the latest update.`,
+    hashtags: ['#update', '#product', '#launch', '#buildinpublic'],
+  })
+
+  if (isMockMode()) {
+    return scriptResultSchema.parse(mock())
+  }
+
+  return generateStructuredObject({
+    schema: scriptResultSchema,
+    mockFactory: mock,
+    prompt: [
+      'Generate a short video script.',
+      `Brief ID: ${input.briefId}`,
+      ...(input.style ? [`Style: ${input.style}`] : []),
+      'Return: hook, full script text, scenes array (each with title, duration in seconds, description), caption, hashtags.',
+      'Keep the video under 30 seconds total.',
+    ].join('\n'),
+  })
+}
+
+export async function renderVideo(
+  input: z.infer<typeof renderInputSchema>,
+  ctx: EngineContext,
+): Promise<{
+  renderId: string
+  status: 'queued' | 'provider_required' | 'failed'
+  estimatedSeconds?: number
+  message?: string
+}> {
+  const hasRenderProvider = (process.env.REMOTION_RENDER_ENABLED ?? String(env.REMOTION_RENDER_ENABLED)) === 'true'
+    || isMockMode()
+
+  if (!hasRenderProvider) {
+    return {
+      renderId: `render_${Date.now()}`,
+      status: 'provider_required',
+      message: 'Video rendering requires configured render provider.',
+      estimatedSeconds: undefined,
+    }
+  }
+
+  return {
+    renderId: `render_${Date.now()}`,
+    status: 'queued',
+    estimatedSeconds: 60,
+  }
+}
+
+export async function createCampaign(
+  input: z.infer<typeof campaignCreateInputSchema>,
+  ctx: EngineContext,
+): Promise<{
+  campaignId: string
+  name: string
+  platform: string
+  brief: z.infer<typeof briefResultSchema> | null
+  scripts: z.infer<typeof scriptResultSchema>[]
+  schedule: string | null
+  status: 'draft'
+}> {
+  return {
+    campaignId: `campaign_${Date.now()}`,
+    name: input.name,
+    platform: input.platform,
+    brief: null,
+    scripts: [],
+    schedule: input.schedule ?? null,
+    status: 'draft',
+  }
+}
+
+export async function packageCampaign(
+  input: z.infer<typeof campaignPackageInputSchema>,
+  ctx: EngineContext,
+): Promise<{
+  packageId: string
+  campaignId: string
+  files: { name: string; type: string; url: string | null }[]
+  summary: string
+  status: 'packaged' | 'pending'
+}> {
+  return {
+    packageId: `pkg_${Date.now()}`,
+    campaignId: input.campaignId,
+    files: [],
+    summary: `Campaign ${input.campaignId} packaged for delivery.`,
+    status: 'packaged',
+  }
+}
diff --git a/src/lib/env/index.ts b/src/lib/env/index.ts
index 76c31a0..2988c75 100644
--- a/src/lib/env/index.ts
+++ b/src/lib/env/index.ts
@@ -50,6 +50,25 @@ const envSchema = z.object({
   ENCRYPTION_SECRET: z.string().optional(),
   HYPERFRAMES_ENABLED: z.coerce.boolean().default(false),
   HYPERFRAMES_BIN: z.string().default("hyperframes"),
+
+  // Talocode Cloud API auth (primary)
+  TALOCODE_API_KEY: z.string().optional(),
+  TALOCODE_BASE_URL: z
+    .preprocess((v) => {
+      if (typeof v !== "string") return v
+      return v.trim().replace(/\/+$/, "")
+    }, z.string().url())
+    .default("https://api.talocode.site"),
+
+  // Legacy ClipLoop API key (deprecated — use TALOCODE_API_KEY instead)
+  CLIPLOOP_API_KEY: z.string().optional(),
+
+  // ClipLoop cloud engine providers (optional)
+  CLIPLOOP_PROVIDER: z.string().optional(),
+  CLIPLOOP_RENDER_PROVIDER: z.string().optional(),
+  REMOTION_RENDER_ENABLED: z.coerce.boolean().default(false),
+  STORAGE_BUCKET: z.string().optional(),
+  STORAGE_PUBLIC_URL: z.string().optional(),
 });
 
 export const env = envSchema.parse({
@@ -86,4 +105,14 @@ export const env = envSchema.parse({
   ENCRYPTION_SECRET: process.env.ENCRYPTION_SECRET,
   HYPERFRAMES_ENABLED: process.env.HYPERFRAMES_ENABLED,
   HYPERFRAMES_BIN: process.env.HYPERFRAMES_BIN,
+
+  TALOCODE_API_KEY: process.env.TALOCODE_API_KEY,
+  TALOCODE_BASE_URL: process.env.TALOCODE_BASE_URL,
+  CLIPLOOP_API_KEY: process.env.CLIPLOOP_API_KEY,
+
+  CLIPLOOP_PROVIDER: process.env.CLIPLOOP_PROVIDER,
+  CLIPLOOP_RENDER_PROVIDER: process.env.CLIPLOOP_RENDER_PROVIDER,
+  REMOTION_RENDER_ENABLED: process.env.REMOTION_RENDER_ENABLED,
+  STORAGE_BUCKET: process.env.STORAGE_BUCKET,
+  STORAGE_PUBLIC_URL: process.env.STORAGE_PUBLIC_URL,
 });
diff --git a/src/lib/talocode-auth.ts b/src/lib/talocode-auth.ts
new file mode 100644
index 0000000..5603d65
--- /dev/null
+++ b/src/lib/talocode-auth.ts
@@ -0,0 +1,69 @@
+/**
+ * Talocode Cloud API authentication for ClipLoop hosted API.
+ *
+ * Accepts TALOCODE_API_KEY (primary) and CLIPLOOP_API_KEY (deprecated fallback).
+ */
+
+export interface TalocodeAuthResult {
+  valid: boolean
+  keyType: 'talocode' | 'cliploop_legacy' | null
+  reason?: string
+}
+
+/**
+ * Resolve the effective API key from env, preferring TALOCODE_API_KEY.
+ * Logs a deprecation warning when falling back to CLIPLOOP_API_KEY.
+ */
+export function getEffectiveApiKey(): string | undefined {
+  if (process.env.TALOCODE_API_KEY) {
+    return process.env.TALOCODE_API_KEY
+  }
+  if (process.env.CLIPLOOP_API_KEY) {
+    console.warn('[talocode-auth] CLIPLOOP_API_KEY is deprecated. Use TALOCODE_API_KEY for hosted ClipLoop API access.')
+    return process.env.CLIPLOOP_API_KEY
+  }
+  return undefined
+}
+
+/**
+ * Validate an incoming API key against configured keys.
+ *
+ * - If TALOCODE_API_KEY is set, only accept that.
+ * - If only CLIPLOOP_API_KEY is set (legacy), accept that.
+ * - If neither is set, return not_configured error.
+ */
+export function validateApiKey(incomingKey: string | null | undefined): TalocodeAuthResult {
+  if (!incomingKey) {
+    return { valid: false, keyType: null, reason: 'MISSING_API_KEY' }
+  }
+
+  const talocodeKey = process.env.TALOCODE_API_KEY
+  const cliploopKey = process.env.CLIPLOOP_API_KEY
+
+  if (talocodeKey && incomingKey === talocodeKey) {
+    return { valid: true, keyType: 'talocode' }
+  }
+
+  if (cliploopKey && incomingKey === cliploopKey) {
+    return { valid: true, keyType: 'cliploop_legacy' }
+  }
+
+  return { valid: false, keyType: null, reason: 'INVALID_API_KEY' }
+}
+
+/**
+ * Extract the API key from request headers, supporting:
+ * - Authorization: Bearer <key>
+ * - X-Api-Key: <key>
+ */
+export function extractApiKeyFromRequest(request: Request): string | null {
+  const authHeader = request.headers.get('authorization')
+  if (authHeader?.startsWith('Bearer ')) {
+    return authHeader.slice(7)
+  }
+  const xApiKey = request.headers.get('x-api-key')
+  if (xApiKey) {
+    return xApiKey
+  }
+  return null
+}
diff --git a/src/lib/talocode-billing.ts b/src/lib/talocode-billing.ts
new file mode 100644
index 0000000..cbf6cda
--- /dev/null
+++ b/src/lib/talocode-billing.ts
@@ -0,0 +1,93 @@
+/**
+ * Talocode Cloud billing integration for ClipLoop hosted API.
+ *
+ * Charges credits via Talocode Cloud billing endpoint before expensive work.
+ */
+
+export interface TalocodeChargeInput {
+  product: string
+  action: string
+  credits: number
+  requestId: string
+  idempotencyKey?: string
+  metadata?: Record<string, unknown>
+}
+
+export interface TalocodeChargeResult {
+  success: boolean
+  remainingCredits?: number
+  error?: {
+    code: string
+    message: string
+    required?: number
+    available?: number
+  }
+}
+
+function getTalocodeBaseUrl(): string {
+  return process.env.TALOCODE_BASE_URL
+    ?? process.env.STACKLANE_API_BASE_URL
+    ?? 'https://api.talocode.site'
+}
+
+export async function chargeCredits(
+  apiKey: string,
+  input: TalocodeChargeInput,
+): Promise<TalocodeChargeResult> {
+  const url = `${getTalocodeBaseUrl()}/api/v1/cloud/usage/charge`
+
+  try {
+    const response = await fetch(url, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        Authorization: `Bearer ${apiKey}`,
+      },
+      body: JSON.stringify(input),
+    })
+
+    if (response.status === 401) {
+      return {
+        success: false,
+        error: { code: 'auth_error', message: 'Invalid or missing API key.' },
+      }
+    }
+
+    if (response.status === 402) {
+      const body = await response.json().catch(() => ({}))
+      return {
+        success: false,
+        error: {
+          code: 'insufficient_credits',
+          message: 'Insufficient Talocode Cloud credits.',
+          required: body.required ?? input.credits,
+          available: body.available,
+        },
+      }
+    }
+
+    if (!response.ok) {
+      return {
+        success: false,
+        error: {
+          code: 'billing_unavailable',
+          message: `Billing service returned status ${response.status}.`,
+        },
+      }
+    }
+
+    const body = await response.json()
+    return {
+      success: true,
+      remainingCredits: body.remainingCredits ?? body.data?.remainingCredits,
+    }
+  } catch (err) {
+    return {
+      success: false,
+      error: {
+        code: 'billing_unavailable',
+        message: err instanceof Error ? err.message : 'Billing service unreachable.',
+      },
+    }
+  }
+}
diff --git a/src/lib/talocode-route-handler.ts b/src/lib/talocode-route-handler.ts
new file mode 100644
index 0000000..2ca5219
--- /dev/null
+++ b/src/lib/talocode-route-handler.ts
@@ -0,0 +1,63 @@
+import { validateApiKey, extractApiKeyFromRequest } from './talocode-auth'
+import { chargeCredits } from './talocode-billing'
+
+export interface RouteHandlerOptions {
+  action: string
+  credits: number
+  getRequestId?: () => string
+}
+
+const defaultGetRequestId = () =>
+  `clp_req_${Date.now()}_${Math.random().toString(36).slice(2, 9)}`
+
+export async function handleRoute(
+  request: Request,
+  options: RouteHandlerOptions,
+  execute: () => Promise<Response>,
+): Promise<Response> {
+  const apiKey = extractApiKeyFromRequest(request)
+  const auth = validateApiKey(apiKey)
+  const getRequestId = options.getRequestId ?? defaultGetRequestId
+
+  if (!auth.valid) {
+    if (auth.reason === 'MISSING_API_KEY') {
+      return Response.json(
+        { ok: false, error: { code: 'missing_api_key', message: 'Missing Talocode Cloud API key. Provide via Authorization: Bearer header or X-Api-Key header.' } },
+        { status: 401 },
+      )
+    }
+    return Response.json(
+      { ok: false, error: { code: 'invalid_api_key', message: 'Invalid API key.' } },
+      { status: 401 },
+    )
+  }
+
+  if (auth.keyType === 'cliploop_legacy') {
+    console.warn('[talocode-auth] CLIPLOOP_API_KEY is deprecated. Use TALOCODE_API_KEY for hosted ClipLoop API access.')
+  }
+
+  const requestId = getRequestId()
+
+  const chargeResult = await chargeCredits(apiKey, {
+    product: 'cliploop',
+    action: options.action,
+    credits: options.credits,
+    requestId,
+    idempotencyKey: requestId,
+    metadata: {
+      route: `/v1/cliploop/${options.action.replace('.', '/')}`,
+      mode: 'hosted',
+    },
+  })
+
+  if (!chargeResult.success) {
+    const err = chargeResult.error!
+    const status = err.code === 'insufficient_credits' ? 402 : err.code === 'auth_error' ? 401 : 502
+    return Response.json(
+      { ok: false, error: err },
+      { status },
+    )
+  }
+
+  return execute()
+}
diff --git a/src/tests/cliploop-cloud-engine.test.ts b/src/tests/cliploop-cloud-engine.test.ts
new file mode 100644
index 0000000..76c93b6
--- /dev/null
+++ b/src/tests/cliploop-cloud-engine.test.ts
@@ -0,0 +1,166 @@
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import {
+  generateBrief,
+  generateScript,
+  renderVideo,
+  createCampaign,
+  packageCampaign,
+  briefInputSchema,
+  scriptInputSchema,
+  renderInputSchema,
+  campaignCreateInputSchema,
+  campaignPackageInputSchema,
+} from '@/lib/cliploop-cloud-engine'
+
+const ORIGINAL_ENV = { ...process.env }
+
+test.afterEach(() => {
+  Object.assign(process.env, ORIGINAL_ENV)
+})
+
+test.after(() => {
+  Object.assign(process.env, ORIGINAL_ENV)
+})
+
+const mockContext = {
+  requestId: 'test_req_1',
+  keyType: 'talocode' as const,
+  action: 'brief.generate',
+  credits: 15,
+  mode: 'hosted' as const,
+  idempotencyKey: 'idem_test_1',
+}
+
+// ─── Schema Validation ───────────────────────────────────────────────────
+
+test('briefInputSchema: rejects empty productName', () => {
+  const result = briefInputSchema.safeParse({ productName: '', update: 'test' })
+  assert.equal(result.success, false)
+})
+
+test('briefInputSchema: accepts valid input', () => {
+  const result = briefInputSchema.safeParse({ productName: 'Test', update: 'We shipped X' })
+  assert.equal(result.success, true)
+})
+
+test('scriptInputSchema: rejects missing briefId', () => {
+  const result = scriptInputSchema.safeParse({})
+  assert.equal(result.success, false)
+})
+
+test('scriptInputSchema: accepts valid input', () => {
+  const result = scriptInputSchema.safeParse({ briefId: 'brief_123' })
+  assert.equal(result.success, true)
+})
+
+test('renderInputSchema: accepts valid input', () => {
+  const result = renderInputSchema.safeParse({ scriptId: 'script_123' })
+  assert.equal(result.success, true)
+})
+
+test('campaignCreateInputSchema: rejects missing name', () => {
+  const result = campaignCreateInputSchema.safeParse({ platform: 'tiktok' })
+  assert.equal(result.success, false)
+})
+
+test('campaignCreateInputSchema: rejects missing platform', () => {
+  const result = campaignCreateInputSchema.safeParse({ name: 'Test' })
+  assert.equal(result.success, false)
+})
+
+test('campaignPackageInputSchema: rejects missing campaignId', () => {
+  const result = campaignPackageInputSchema.safeParse({})
+  assert.equal(result.success, false)
+})
+
+// ─── Engine: deterministic fallback (mock mode) ─────────────────────────
+
+test('generateBrief: returns deterministic result in mock mode', async () => {
+  process.env.MOCK_LLM = 'true'
+  process.env.LLM_PROVIDER = 'mock'
+  const result = await generateBrief(
+    { productName: 'TestApp', update: 'Launched new API', audience: 'developers', platform: 'x' },
+    mockContext,
+  )
+  assert.ok(result.title)
+  assert.ok(result.angle)
+  assert.ok(result.hook)
+  assert.ok(Array.isArray(result.keyPoints))
+  assert.ok(result.keyPoints.length >= 1)
+  assert.ok(result.cta)
+})
+
+test('generateScript: returns deterministic result with scenes', async () => {
+  process.env.MOCK_LLM = 'true'
+  const result = await generateScript({ briefId: 'brief_123', style: 'storytelling' }, {
+    ...mockContext, action: 'script.generate', credits: 15,
+  })
+  assert.ok(result.hook)
+  assert.ok(result.script)
+  assert.ok(Array.isArray(result.scenes))
+  assert.ok(result.scenes.length >= 1)
+  assert.ok(result.caption)
+  assert.ok(Array.isArray(result.hashtags))
+})
+
+test('renderVideo: returns provider_required when not configured', async () => {
+  process.env.REMOTION_RENDER_ENABLED = 'false'
+  process.env.MOCK_LLM = 'false'
+  const result = await renderVideo({ scriptId: 'script_123', format: 'portrait' }, {
+    ...mockContext, action: 'video.render', credits: 200,
+  })
+  assert.equal(result.status, 'provider_required')
+  assert.ok(result.message?.includes('render provider'))
+})
+
+test('renderVideo: returns queued when configured', async () => {
+  process.env.REMOTION_RENDER_ENABLED = 'true'
+  const result = await renderVideo({ scriptId: 'script_123' }, {
+    ...mockContext, action: 'video.render', credits: 200,
+  })
+  assert.equal(result.status, 'queued')
+  assert.ok(result.estimatedSeconds)
+})
+
+test('renderVideo: returns queued in mock mode', async () => {
+  process.env.MOCK_LLM = 'true'
+  process.env.REMOTION_RENDER_ENABLED = 'false'
+  const result = await renderVideo({ scriptId: 'script_123' }, {
+    ...mockContext, action: 'video.render', credits: 200,
+  })
+  assert.equal(result.status, 'queued')
+})
+
+test('createCampaign: returns campaign object', async () => {
+  const result = await createCampaign({ name: 'Q3 Launch', platform: 'tiktok', schedule: '2026-07-15' }, {
+    ...mockContext, action: 'campaign.create', credits: 50,
+  })
+  assert.ok(result.campaignId)
+  assert.equal(result.name, 'Q3 Launch')
+  assert.equal(result.platform, 'tiktok')
+  assert.equal(result.schedule, '2026-07-15')
+  assert.equal(result.status, 'draft')
+  assert.ok(Array.isArray(result.scripts))
+})
+
+test('packageCampaign: returns package object', async () => {
+  const result = await packageCampaign({ campaignId: 'campaign_123' }, {
+    ...mockContext, action: 'campaign.package', credits: 400,
+  })
+  assert.ok(result.packageId)
+  assert.equal(result.campaignId, 'campaign_123')
+  assert.equal(result.status, 'packaged')
+  assert.ok(Array.isArray(result.files))
+  assert.ok(result.summary)
+})
+
+// ─── Engine: not called when auth/billing fails (handled by route handler) ─
+
+test('engine exports are functions', () => {
+  assert.equal(typeof generateBrief, 'function')
+  assert.equal(typeof generateScript, 'function')
+  assert.equal(typeof renderVideo, 'function')
+  assert.equal(typeof createCampaign, 'function')
+  assert.equal(typeof packageCampaign, 'function')
+})
diff --git a/src/tests/talocode-cloud-api-key.test.ts b/src/tests/talocode-cloud-api-key.test.ts
new file mode 100644
index 0000000..ec35d0b
--- /dev/null
+++ b/src/tests/talocode-cloud-api-key.test.ts
@@ -0,0 +1,351 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { validateApiKey, extractApiKeyFromRequest, getEffectiveApiKey } from "@/lib/talocode-auth";
+import { handleRoute } from "@/lib/talocode-route-handler";
+import { chargeCredits } from "@/lib/talocode-billing";
+
+const ORIGINAL_ENV = { ...process.env };
+
+test.afterEach(() => {
+  Object.assign(process.env, ORIGINAL_ENV);
+});
+
+test.after(() => {
+  Object.assign(process.env, ORIGINAL_ENV);
+});
+
+// ─── getEffectiveApiKey ────────────────────────────────────────────────
+
+test("talocode-auth: prefers TALOCODE_API_KEY over CLIPLOOP_API_KEY", () => {
+  process.env.TALOCODE_API_KEY = "tk_abc123";
+  process.env.CLIPLOOP_API_KEY = "clp_def456";
+  assert.equal(getEffectiveApiKey(), "tk_abc123");
+});
+
+test("talocode-auth: falls back to CLIPLOOP_API_KEY when TALOCODE_API_KEY not set", () => {
+  delete process.env.TALOCODE_API_KEY;
+  process.env.CLIPLOOP_API_KEY = "clp_def456";
+  assert.equal(getEffectiveApiKey(), "clp_def456");
+});
+
+test("talocode-auth: returns undefined when no key set", () => {
+  delete process.env.TALOCODE_API_KEY;
+  delete process.env.CLIPLOOP_API_KEY;
+  assert.equal(getEffectiveApiKey(), undefined);
+});
+
+test("talocode-auth: deprecation warning when using CLIPLOOP_API_KEY in getEffectiveApiKey", () => {
+  delete process.env.TALOCODE_API_KEY;
+  process.env.CLIPLOOP_API_KEY = "clp_def456";
+  const warnings: string[] = [];
+  const origWarn = console.warn;
+  console.warn = (msg: string) => { warnings.push(msg) };
+  try {
+    getEffectiveApiKey();
+    assert.ok(warnings.some(w => w.includes("CLIPLOOP_API_KEY is deprecated")));
+  } finally {
+    console.warn = origWarn;
+  }
+});
+
+// ─── validateApiKey ─────────────────────────────────────────────────────
+
+test("talocode-auth: validates correct TALOCODE_API_KEY", () => {
+  process.env.TALOCODE_API_KEY = "tk_abc123";
+  delete process.env.CLIPLOOP_API_KEY;
+  const result = validateApiKey("tk_abc123");
+  assert.equal(result.valid, true);
+  assert.equal(result.keyType, "talocode");
+});
+
+test("talocode-auth: accepts legacy CLIPLOOP_API_KEY", () => {
+  delete process.env.TALOCODE_API_KEY;
+  process.env.CLIPLOOP_API_KEY = "clp_def456";
+  const result = validateApiKey("clp_def456");
+  assert.equal(result.valid, true);
+  assert.equal(result.keyType, "cliploop_legacy");
+});
+
+test("talocode-auth: rejects wrong key", () => {
+  process.env.TALOCODE_API_KEY = "tk_abc123";
+  const result = validateApiKey("wrong_key");
+  assert.equal(result.valid, false);
+  assert.equal(result.reason, "INVALID_API_KEY");
+});
+
+test("talocode-auth: rejects missing key", () => {
+  const result = validateApiKey(null);
+  assert.equal(result.valid, false);
+  assert.equal(result.reason, "MISSING_API_KEY");
+});
+
+test("talocode-auth: rejects undefined key", () => {
+  const result = validateApiKey(undefined);
+  assert.equal(result.valid, false);
+  assert.equal(result.reason, "MISSING_API_KEY");
+});
+
+// ─── extractApiKeyFromRequest ───────────────────────────────────────────
+
+test("talocode-auth: extracts from Authorization Bearer header", () => {
+  const headers = new Headers({ authorization: "Bearer tk_abc123" });
+  const req = new Request("http://localhost", { headers });
+  assert.equal(extractApiKeyFromRequest(req), "tk_abc123");
+});
+
+test("talocode-auth: extracts from X-Api-Key header", () => {
+  const headers = new Headers({ "x-api-key": "tk_abc123" });
+  const req = new Request("http://localhost", { headers });
+  assert.equal(extractApiKeyFromRequest(req), "tk_abc123");
+});
+
+test("talocode-auth: Authorization Bearer takes precedence over X-Api-Key", () => {
+  const headers = new Headers({
+    authorization: "Bearer tk_primary",
+    "x-api-key": "tk_secondary",
+  });
+  const req = new Request("http://localhost", { headers });
+  assert.equal(extractApiKeyFromRequest(req), "tk_primary");
+});
+
+test("talocode-auth: returns null when no auth header", () => {
+  const req = new Request("http://localhost");
+  assert.equal(extractApiKeyFromRequest(req), null);
+});
+
+test("talocode-auth: handles empty Authorization header", () => {
+  const headers = new Headers({ authorization: "" });
+  const req = new Request("http://localhost", { headers });
+  assert.equal(extractApiKeyFromRequest(req), null);
+});
+
+test("talocode-auth: handles Authorization without Bearer prefix", () => {
+  const headers = new Headers({ authorization: "Basic abc123" });
+  const req = new Request("http://localhost", { headers });
+  assert.equal(extractApiKeyFromRequest(req), null);
+});
+
+// ─── Key redaction in errors ──────────────────────────────────────────
+
+test("talocode-auth: raw keys not logged in error messages", async () => {
+  process.env.TALOCODE_API_KEY = "tk_secret_value";
+  const result = validateApiKey(null);
+  assert.equal(result.valid, false);
+  assert.ok(!result.reason?.includes("tk_"));
+});
+
+test("talocode-auth: key type is talocode not the actual key value", () => {
+  process.env.TALOCODE_API_KEY = "tk_abc123";
+  const result = validateApiKey("tk_abc123");
+  assert.equal(result.valid, true);
+  assert.equal(result.keyType, "talocode");
+  // Make sure keyType doesn't include the actual key
+  assert.ok(!result.keyType?.includes("tk_"));
+});
+
+// ─── handleRoute auth failures ──────────────────────────────────────────
+
+test("talocode-route-handler: returns 401 for missing API key", async () => {
+  process.env.TALOCODE_API_KEY = "tk_abc123";
+  const request = new Request("http://localhost/v1/cliploop/brief/generate", {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ prompt: "test" }),
+  });
+  const response = await handleRoute(
+    request,
+    { action: "brief.generate", credits: 15 },
+    async () => new Response("ok", { status: 200 }),
+  );
+  assert.equal(response.status, 401);
+  const body = await response.json();
+  assert.equal(body.ok, false);
+  assert.equal(body.error.code, "missing_api_key");
+});
+
+test("talocode-route-handler: returns 401 for invalid API key", async () => {
+  process.env.TALOCODE_API_KEY = "tk_abc123";
+  const request = new Request("http://localhost/v1/cliploop/brief/generate", {
+    method: "POST",
+    headers: {
+      "content-type": "application/json",
+      authorization: "Bearer wrong_key",
+    },
+    body: JSON.stringify({ prompt: "test" }),
+  });
+  const response = await handleRoute(
+    request,
+    { action: "brief.generate", credits: 15 },
+    async () => new Response("ok", { status: 200 }),
+  );
+  assert.equal(response.status, 401);
+  const body = await response.json();
+  assert.equal(body.ok, false);
+  assert.equal(body.error.code, "invalid_api_key");
+});
+
+// ─── handleRoute deprecation warning ──────────────────────────────────
+
+test("talocode-route-handler: warns on CLIPLOOP_API_KEY usage", async () => {
+  delete process.env.TALOCODE_API_KEY;
+  process.env.CLIPLOOP_API_KEY = "clp_def456";
+  process.env.TALOCODE_BASE_URL = "http://localhost:9999"; // won't be reached
+
+  const request = new Request("http://localhost/v1/cliploop/brief/generate", {
+    method: "POST",
+    headers: {
+      "content-type": "application/json",
+      authorization: "Bearer clp_def456",
+    },
+    body: JSON.stringify({ prompt: "test" }),
+  });
+
+  const warnings: string[] = [];
+  const origWarn = console.warn;
+  console.warn = (msg: string) => { warnings.push(msg) };
+  try {
+    await handleRoute(
+      request,
+      { action: "brief.generate", credits: 15 },
+      async () => new Response("ok", { status: 200 }),
+    );
+    assert.ok(warnings.some(w => w.includes("CLIPLOOP_API_KEY is deprecated")));
+  } finally {
+    console.warn = origWarn;
+  }
+});
+
+// ─── chargeCredits ─────────────────────────────────────────────────────
+
+test("talocode-billing: returns billing_unavailable when service unreachable", async () => {
+  process.env.TALOCODE_BASE_URL = "http://localhost:1"; // unreachable port
+  const result = await chargeCredits("tk_abc123", {
+    product: "cliploop",
+    action: "brief.generate",
+    credits: 15,
+    requestId: "test-1",
+  });
+  assert.equal(result.success, false);
+  assert.equal(result.error?.code, "billing_unavailable");
+});
+
+test("talocode-billing: uses TALOCODE_BASE_URL from env", () => {
+  process.env.TALOCODE_BASE_URL = "https://custom.example.com";
+  // Test by making a request to a non-existent endpoint
+  // The URL construction is tested indirectly via chargeCredits failure
+  assert.ok(true);
+});
+
+// ─── handleRoute billing behavior ─────────────────────────────────────
+
+test("talocode-route-handler: returns structured JSON errors", async () => {
+  process.env.TALOCODE_API_KEY = "tk_abc123";
+  const request = new Request("http://localhost/v1/cliploop/brief/generate", {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ prompt: "test" }),
+  });
+  const response = await handleRoute(
+    request,
+    { action: "brief.generate", credits: 15 },
+    async () => new Response("ok", { status: 200 }),
+  );
+  const body = await response.json();
+  // Should have structured JSON with ok and error fields
+  assert.equal(typeof body, "object");
+  assert.equal("ok" in body, true);
+  assert.equal("error" in body, true);
+});
+
+test("talocode-route-handler: idempotency key is generated", async () => {
+  process.env.TALOCODE_API_KEY = "tk_abc123";
+  const request = new Request("http://localhost/v1/cliploop/brief/generate", {
+    method: "POST",
+    headers: {
+      "content-type": "application/json",
+      authorization: "Bearer tk_abc123",
+    },
+    body: JSON.stringify({ prompt: "test" }),
+  });
+  // We can't easily test billing without a service, but we can verify
+  // that the route handler structure is correct
+  const response = await handleRoute(
+    request,
+    { action: "brief.generate", credits: 15, getRequestId: () => "test-id-1" },
+    async () => {
+      return Response.json({ ok: true, charged: true });
+    },
+  );
+  // Since billing will fail (no service), we expect 502
+  assert.equal(response.status, 502);
+});
+
+// ─── Engine NOT called when auth/billing fails ───────────────────────────
+
+test("talocode-route-handler: engine not called on missing auth", async () => {
+  process.env.TALOCODE_API_KEY = "tk_abc123";
+  let engineCalled = false;
+  const request = new Request("http://localhost/v1/cliploop/brief/generate", {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ productName: "Test", update: "test" }),
+  });
+  const response = await handleRoute(
+    request,
+    { action: "brief.generate", credits: 15 },
+    async () => {
+      engineCalled = true;
+      return Response.json({ ok: true });
+    },
+  );
+  assert.equal(response.status, 401);
+  assert.equal(engineCalled, false);
+});
+
+test("talocode-route-handler: engine not called on invalid auth", async () => {
+  process.env.TALOCODE_API_KEY = "tk_abc123";
+  let engineCalled = false;
+  const request = new Request("http://localhost/v1/cliploop/brief/generate", {
+    method: "POST",
+    headers: {
+      "content-type": "application/json",
+      authorization: "Bearer wrong_key",
+    },
+    body: JSON.stringify({ productName: "Test", update: "test" }),
+  });
+  const response = await handleRoute(
+    request,
+    { action: "brief.generate", credits: 15 },
+    async () => {
+      engineCalled = true;
+      return Response.json({ ok: true });
+    },
+  );
+  assert.equal(response.status, 401);
+  assert.equal(engineCalled, false);
+});
+
+test("talocode-route-handler: engine not called on billing failure", async () => {
+  process.env.TALOCODE_API_KEY = "tk_abc123";
+  process.env.TALOCODE_BASE_URL = "http://localhost:1";
+  let engineCalled = false;
+  const request = new Request("http://localhost/v1/cliploop/brief/generate", {
+    method: "POST",
+    headers: {
+      "content-type": "application/json",
+      authorization: "Bearer tk_abc123",
+    },
+    body: JSON.stringify({ productName: "Test", update: "test" }),
+  });
+  const response = await handleRoute(
+    request,
+    { action: "brief.generate", credits: 15, getRequestId: () => "test-id" },
+    async () => {
+      engineCalled = true;
+      return Response.json({ ok: true });
+    },
+  );
+  // Billing unreachable -> 502
+  assert.equal(response.status, 502);
+  assert.equal(engineCalled, false);
+});