Bearer token
Every endpoint except the demo requires an API key. Keys start with ffk_, are shown once at creation and stored hashed. Send them as a bearer token:
X-Api-Key and ?api_key= are also accepted for quick browser tests, but prefer the header in production. CORS is enabled, but keys belong in server-side code: never ship one in a browser bundle.
Keys and limits
The Free plan has one active key; paid plans allow up to ten, so each project or environment can have its own. Revoke a compromised key from the dashboard: requests using it fail immediately with 401 revoked_api_key. Credits are counted per account, across all keys.
MCP server
The MCP server at https://fundfactsapi.com/api/mcp uses the same key, sent as the same Authorization header by the MCP client.