Authentication

FacetFlux authenticates API and MCP requests with an API key sent in the Authorization header:

Authorization: Bearer <your-api-key>

Every key belongs to a single tenant, and every response is scoped to that tenant’s data. There is no separate account ID to send — the key identifies the tenant.

Creating a key

Sign in at app.facetflux.com as a tenant admin.
Go to Settings → API keys.
Click Create new key, give it a name, and choose a permission level (see below).
Copy the key immediately — it’s shown once and cannot be retrieved later. Only the last four characters are visible afterward.

Treat API keys like passwords. A key grants access to your entire tenant’s catalog within its permission level. If a key leaks, delete it from Settings → API keys and mint a new one.

Permission levels

When you create a key you pick what it’s allowed to do. This is enforced on both the REST API and the MCP server.

Permission	Can read	Can write	Use it for
Read-only	Yes	No	Sync catalog data out, dashboards, reporting, read-only agents.
Read & write	Yes	Yes	Integrations that push products, run enrichment, or trigger exports.
Admin	Yes	Yes	Automation that also manages tenant settings.

A read-only key can only make GET requests on the REST API; any mutating call returns 403 with read_only_api_key. On the MCP server, read-only keys can call read tools but mutating tools return a read_only_key error. Choose the narrowest permission that does the job.

Using the key

curl https://app.facetflux.com/api/v1/public/products \
  -H "Authorization: Bearer $FACETFLUX_API_KEY"

import os, requests

resp = requests.get(
    "https://app.facetflux.com/api/v1/public/products",
    headers={"Authorization": f"Bearer {os.environ['FACETFLUX_API_KEY']}"},
)
resp.raise_for_status()
print(resp.json())

const resp = await fetch("https://app.facetflux.com/api/v1/public/products", {
  headers: { Authorization: `Bearer ${process.env.FACETFLUX_API_KEY}` },
});
if (!resp.ok) throw new Error(`${resp.status} ${await resp.text()}`);
console.log(await resp.json());

Keep keys out of source control. Read them from an environment variable or a secrets manager, as the examples above do.

Get started

Guides

AI & agents

Creating a key

Permission levels

Using the key

​Creating a key

​Permission levels

​Using the key

Creating a key

Permission levels

Using the key