Authentication

Bearer API keys (available now)

Create a key in Settings → API (workspace admin only). Choose a scope — read for lookups only, or read+write to also analyze videos, create niches, search trends and generate scripts. The full key (fyp_sk_...) is shown exactly once, at creation, with a copy button. After that, only its key_prefix (e.g. fyp_sk_a1b2c) and a SHA-256 hash are stored — it cannot be shown again, even to us.

Authorization: Bearer fyp_sk_...

Revoking a key in Settings is immediate and permanent. The API checks whether a key is revoked on every request, not only when it is first used.

OAuth (coming)

Both the ChatGPT app directory and the Claude Connectors Directory require OAuth for a listed connector, and the API already accepts a Supabase-issued OAuth access token on the same Authorization header a bearer key uses. What is still missing is the product-side connect flow — an authorization screen where you pick which organization the connection acts on — so OAuth is not yet something you can start from the dashboard. Bearer keys are the only way to connect today.

The org-binding rule

Every credential — a bearer key today, an OAuth grant later — acts on exactly one organization. There is no request parameter that lets a credential reach a second workspace, and no way to repoint an existing key at a different org. To use the API against another organization, create a separate key there (or, once OAuth ships, connect again and choose that organization).

What makes a credential stop working

Every request re-checks entitlement, not just at creation: the organization must have subscription_status = 'active' and a plan other than Free — the same rule, applied the same way, whether the credential is a year old or was minted a second ago. A trial counts as active. A key minted while the workspace was on an active plan stops working the moment that plan lapses, is canceled, or the workspace drops to Free — even though the key itself was never touched. That returns 403 api_access_required.

• 401 missing_api_key — no Authorization header at all.
• 401 invalid_api_key — the credential isn't a recognised key or valid token.
• 401 revoked_api_key — that key was revoked in Settings.
• 403 connection_revoked — that OAuth connection was revoked.
• 403 write_scope_required — a read-only key called a write endpoint or tool.