Getting started

Authentication

Every request carries your API key as a bearer token.

Sending the API key

The secret is prefixed ft_live_ — or ft_test_ for a test key (see Test mode) — store it like a password. It is shown at creation, and the dashboard can show it again after an emailed verification code, so a lost secret is no reason to rotate a key an integration is running on. A request with a missing or unrecognized key answers 401 with the hint expected: Bearer ft_live_... or ft_test_....

Authorization: Bearer ft_live_...
Authorization: Bearer ft_test_...

Revoking and rotating a key

A revoked key stops working immediately. Rotating a key mints a new secret and kills the old one at once.

Never put ft_live_ in frontend code or a public repository. Call the API only from your own server. A ft_test_ key moves no money, but treat it the same way — it is still a secret.