> ## Documentation Index
> Fetch the complete documentation index at: https://docs.forecastable.com/llms.txt
> Use this file to discover all available pages before exploring further.

# API keys

> Create and manage Integration API keys for direct REST and MCP access.

Integration API keys are long-lived bearer tokens for server-to-server integrations, scripts, and MCP clients that do not support OAuth. Each key is tied to the Forecastable user who created it and can be restricted to specific organizations and scopes.

## When to use API keys

Use an API key when:

* you control the client that stores the credential (your backend, a script, or an MCP client without OAuth)
* you do not need an interactive sign-in / consent flow

Prefer [OAuth](/developers/oauth) for Cursor and Claude when the client can prompt the user to authenticate. API keys remain fully supported for MCP: send `Authorization: Bearer <api-key>` and Forecastable skips the OAuth challenge.

## Prerequisites

* a Forecastable account with the **developer** role
* access to at least one organization you want the key to reach

## Create an API key

Open [Settings → Developer → API Keys](https://app.forecastable.com/settings/api-keys).

1. Click **Create API Key**.
2. Enter a name you will recognize later.
3. Select the [scopes](/developers/scopes) this key needs.
4. Optionally restrict the key to one or more organizations.
5. Optionally set an expiration date.
6. Copy the token when it is shown — Forecastable does not display the full secret again.

Keys are issued with the `fcat_` prefix. Store them in a secrets manager or environment variable, not in source control.

## Use an API key

Send the token as a Bearer credential on Integration API and MCP requests:

```http theme={null}
Authorization: Bearer fcat_YOUR_TOKEN
```

Most endpoints also require organization context. Pass the active organization UUID in a header:

```http theme={null}
X-Organization-Id: YOUR_ORGANIZATION_ID
```

Legacy header `X-Subscriber-Id` and query param `subscriberId` are still accepted.

### Example request

```bash theme={null}
curl -s "https://app.forecastable.com/api/v1/accounts" \
  -H "Authorization: Bearer fcat_YOUR_TOKEN" \
  -H "X-Organization-Id: YOUR_ORGANIZATION_ID"
```

If the key is restricted to a single organization, Forecastable may infer the organization automatically. When multiple identifiers conflict, the API returns `ambiguous_subscriber_context`.

## Manage keys

From the API Keys settings page you can:

* review key name, prefix, scopes, organizations, and last-used time
* revoke a key by deleting it

Revoked keys return `401 unauthorized` on the next request.

Rate limits apply per key and organization. See [Rate limits](/developers/rate-limits) for bucket sizes, response headers, and retry guidance.

## Security practices

* Grant the [narrowest scopes](/developers/scopes) required for the integration.
* Restrict keys to specific organizations when possible.
* Set an expiration date for short-lived automation or proof-of-concept work.
* Rotate keys by creating a replacement, updating clients, then deleting the old key.

## Related guides

<Card title="Quickstart" icon="rocket" href="/quickstart">
  Make your first authenticated Integration API call with a new key.
</Card>

<Card title="Scopes" icon="list" href="/developers/scopes">
  See every approved scope and what it allows.
</Card>

<Card title="Rate limits" icon="gauge" href="/developers/rate-limits">
  Per-token limits, 429 responses, and retry behavior.
</Card>

<Card title="MCP server" icon="https://mintcdn.com/forecastable/fU69crspsqRT-kfC/images/mcp.png?fit=max&auto=format&n=fU69crspsqRT-kfC&q=85&s=ecb2d15b0f6d90ada43faa0eb38b8746" href="/developers/mcp" width="32" height="32" data-path="images/mcp.png">
  Connect Cursor or Claude to Forecastable over MCP.
</Card>