Skip to content
FYInbox
Open navigation

FYInbox docs

API authentication

Authenticate producer and agent requests with a source-scoped bearer key while keeping the secret out of clients, payloads, logs, and source control.

Use the source API key

Send the key in the Authorization header as Bearer <key>. The key can create notifications and read or mutate metadata only for its own source. The public API does not use dashboard cookies, account IDs, or project IDs. Missing, invalid, or revoked keys return HTTP 401 with { error: "unauthorized" }.

Handle the key as a secret

  • Read the key from an environment variable or secret store on a trusted server or automation runtime.
  • Do not use the key from browser JavaScript or ship it in a mobile or desktop bundle.
  • Do not place it in title, body, tags, metadata, actions, URLs, error messages, or logs.
  • Revoke a key in the dashboard if it may have been exposed and create a replacement.