Authentication

Bearer token

Every endpoint except the demo requires an API key. Keys start with ffk_, are shown once at creation and stored hashed. Send them as a bearer token:

Authorization: Bearer ffk_XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

X-Api-Key and ?api_key= are also accepted for quick browser tests, but prefer the header in production. CORS is enabled, but keys belong in server-side code: never ship one in a browser bundle.

Keys and limits

The Free plan has one active key; paid plans allow up to ten, so each project or environment can have its own. Revoke a compromised key from the dashboard: requests using it fail immediately with 401 revoked_api_key. Requests are counted per account, across all keys.

MCP server

The MCP server at https://fundfactsapi.com/api/mcp takes the same key as an Authorization: Bearer header. Connectors without a header field (claude.ai, Claude Desktop, ChatGPT in developer mode), and Claude Code when the server is added without one, sign in with your FundFacts account instead (OAuth 2.1, PKCE); each connection is listed in the dashboard, counts against the same plan and quota, and can be disconnected there. OAuth tokens only work on the MCP server, never on the REST API.

When the key is part of the URL, create a dedicated key in the dashboard for the connector and revoke it there if it leaks; header auth stays the recommended form for code and CLIs.