API keys and assistant sign-in

API keys for scripts and tools

An owner makes API keys under Account, AI & API, API keys: a name, the companies, what it may do and when it expires. The key is shown once, and Fydioo keeps only a fingerprint of it. Send it with every request as a bearer token:

curl https://fydioo.com/api/v1/posts?state=pending_review \
  -H "Authorization: Bearer fyd_live_…"

Assistants sign in

Claude, ChatGPT, Codex, Gemini and other MCP clients sign in instead: the assistant sends you to Fydioo, you sign in, choose the account, the companies and what it may do, and allow it. The assistant never sees your password, and its access renews itself until you disconnect it.

Keeping keys safe

A key acts in your account with the access it was given, so:

• Keep it like a password, never in code others can read.
• Make one key per tool, so you can revoke one without the others.
• Give it an end date unless something must run for good.
• Revoke a key the moment it may have leaked; it stops working at once.
• A key stops working when the owner who made it is no longer an owner.