Authentication
API keys for scripts and CI, OAuth for AI assistants.
API keys
Create a key in the dashboard under Settings, API keys. Give it a name you'll recognise later (laptop, github-actions). The key is shown once; we store only a hash of it, so we can't show it again. Lost it? Revoke it and create a new one.
Send the key on every call:
Authorization: Bearer fpk_...Keep keys out of code
Read the key from an environment variable or your CI's secret store. Anyone with the key can publish and delete sites on your account. Never put it in a page you publish.
A key works until you revoke it. Revoking takes effect at once.
OAuth (MCP clients)
Claude, ChatGPT, Claude Code, Cursor and other MCP clients don't need a key. They sign in with OAuth 2.1 (dynamic client registration and PKCE): you sign in to Flatpage in a pop-up and choose Allow. See MCP server.
Connected apps are listed in Settings next to your keys; disconnecting one stops it at once. An OAuth access token also works as a Bearer token on /v1.
Who can use the API
- Every plan, Free included. Your plan's limits apply as in the dashboard.
- Your email must be verified. Until it is, calls answer
403.
Failed authentication
| Status | Meaning |
|---|---|
401 | No Authorization header, or the key was revoked or never existed. |
403 | The key is fine but your email isn't verified yet. |
401 answers on /v1 and /mcp carry a WWW-Authenticate header pointing MCP clients at the OAuth sign-in.