Skip to main content
Integration API keys are long-lived bearer tokens for server-to-server integrations, scripts, and MCP clients that do not support OAuth. Each key is tied to the Forecastable user who created it and can be restricted to specific organizations and scopes.

​
When to use API keys

Use an API key when:
  • you control the client that stores the credential (your backend, a script, or an MCP client without OAuth)
  • you do not need an interactive sign-in / consent flow
Prefer OAuth for Cursor and Claude when the client can prompt the user to authenticate. API keys remain fully supported for MCP: send Authorization: Bearer <api-key> and Forecastable skips the OAuth challenge.

​
Prerequisites

  • a Forecastable account with the developer role
  • access to at least one organization you want the key to reach

​
Create an API key

Open Settings → Developer → API Keys.
  1. Click Create API Key.
  2. Enter a name you will recognize later.
  3. Select the scopes this key needs.
  4. Optionally restrict the key to one or more organizations.
  5. Optionally set an expiration date.
  6. Copy the token when it is shown — Forecastable does not display the full secret again.
Keys are issued with the fcat_ prefix. Store them in a secrets manager or environment variable, not in source control.

​
Use an API key

Send the token as a Bearer credential on Integration API and MCP requests:
Most endpoints also require organization context. Pass the active organization UUID in a header:
Legacy header X-Subscriber-Id and query param subscriberId are still accepted.

​
Example request

If the key is restricted to a single organization, Forecastable may infer the organization automatically. When multiple identifiers conflict, the API returns ambiguous_subscriber_context.

​
Manage keys

From the API Keys settings page you can:
  • review key name, prefix, scopes, organizations, and last-used time
  • revoke a key by deleting it
Revoked keys return 401 unauthorized on the next request. Rate limits apply per key and organization. See Rate limits for bucket sizes, response headers, and retry guidance.

​
Security practices

  • Grant the narrowest scopes required for the integration.
  • Restrict keys to specific organizations when possible.
  • Set an expiration date for short-lived automation or proof-of-concept work.
  • Rotate keys by creating a replacement, updating clients, then deleting the old key.

Quickstart

Make your first authenticated Integration API call with a new key.

Scopes

See every approved scope and what it allows.

Rate limits

Per-token limits, 429 responses, and retry behavior.

MCP server

Connect Cursor or Claude to Forecastable over MCP.