Authentication

OAuth (Claude and other OAuth clients)

Claude connects over OAuth 2.1 with PKCE and dynamic client registration — point it at https://api.fypnow.com/mcp and it discovers everything else. You approve the connection on a FYPNow screen that asks which workspace it should act on and whether it may write. No key is created, copied or stored anywhere.

The access token is a short-lived Supabase-issued JWT, refreshed automatically. The API validates it against our JWKS on every request and resolves it to the workspace and scope you chose at approval.

Bearer API keys (scripts and non-OAuth clients)

Create a key in Settings → API (workspace admin only). Choose a scope — read for lookups only, or read+write to also analyze videos, create niches, search trends and generate scripts. The full key (fyp_sk_...) is shown exactly once, at creation, with a copy button. After that, only its key_prefix (e.g. fyp_sk_a1b2c) and a SHA-256 hash are stored — it cannot be shown again, even to us.

Authorization: Bearer fyp_sk_...

Revoking a key in Settings is immediate and permanent. The API checks whether a key is revoked on every request, not only when it is first used.

The org-binding rule

Every credential — a bearer key today, an OAuth grant later — acts on exactly one organization. There is no request parameter that lets a credential reach a second workspace, and no way to repoint an existing key at a different org. To use the API against another organization, create a separate key there (or, once OAuth ships, connect again and choose that organization).

What makes a credential stop working

Every request re-checks entitlement, not just at creation: the organization must have subscription_status = 'active' and a plan other than Free — the same rule, applied the same way, whether the credential is a year old or was minted a second ago. A trial counts as active. A key minted while the workspace was on an active plan stops working the moment that plan lapses, is canceled, or the workspace drops to Free — even though the key itself was never touched. That returns 403 api_access_required.

• 401 missing_api_key — no Authorization header at all.
• 401 invalid_api_key — the credential isn't a recognised key or valid token.
• 401 revoked_api_key — that key was revoked in Settings.
• 403 connection_revoked — that OAuth connection was revoked.
• 403 write_scope_required — a read-only key called a write endpoint or tool.