fatsecret · Authentication Profile

Fatsecret Authentication

Authentication

fatsecret secures its APIs with oauth2 and http across 2 declared security schemes, as derived from its OpenAPI definitions. OAuth 2.0 is offered via the clientCredentials flow(s).

Artificial IntelligenceBarcode ScanningCaloriesDietsImage RecognitionNatural Language ProcessingExerciseFitnessFood DiaryHealthMacronutrientsNutritionRecipesWeight TrackingFood and Beverage

Methods: oauth2, http Schemes: 2 OAuth flows: clientCredentials API key in:

Security Schemes

oauth2 oauth2

· flows: clientCredentials

oauth1 http

scheme: oauth

Source

Authentication Profile

generated: '2026-08-12'
method: searched
source: https://platform.fatsecret.com/docs/guides/authentication
docs:
  index: https://platform.fatsecret.com/docs/guides/authentication
  oauth2: https://platform.fatsecret.com/docs/guides/authentication/oauth2
  oauth1: https://platform.fatsecret.com/docs/guides/authentication/oauth1
  oauth1_three_legged: https://platform.fatsecret.com/docs/guides/authentication/oauth1/three-legged
note: >-
  Upgraded from derived to searched on 2026-08-12 with the provider's auth guides and a live probe of
  the authorization server's OIDC discovery document.
summary:
  types: [oauth2, http]
  oauth2_flows: [clientCredentials]
  api_key_in: []
  two_plane: >-
    Two authentication planes that are not interchangeable. Catalog data (foods, recipes, reference)
    uses OAuth 2.0 client_credentials — an APPLICATION identity. Member data (food diary, exercise
    diary, weight, favorites, saved meals) uses 3-legged OAuth 1.0a — a MEMBER identity. An agent
    holding only a client-credentials token cannot read or write any profile surface.
authorization_server:
  issuer: https://oauth.fatsecret.com
  openid_configuration: https://oauth.fatsecret.com/.well-known/openid-configuration
  probed: '2026-08-12'
  http_status: 200
  endpoints:
    authorization: https://oauth.fatsecret.com/connect/authorize
    token: https://oauth.fatsecret.com/connect/token
    userinfo: https://oauth.fatsecret.com/connect/userinfo
    introspection: https://oauth.fatsecret.com/connect/introspect
    revocation: https://oauth.fatsecret.com/connect/revocation
    device_authorization: https://oauth.fatsecret.com/connect/deviceauthorization
    end_session: https://oauth.fatsecret.com/connect/endsession
    jwks: https://oauth.fatsecret.com/.well-known/openid-configuration/jwks
  id_token_signing_alg: [RS256]
  code_challenge_methods: [plain, S256]
  subject_types: [public]
schemes:
  - name: oauth2
    type: oauth2
    flows:
      - flow: clientCredentials
        tokenUrl: https://oauth.fatsecret.com/connect/token
        scopes: 7
        scope_list: [basic, premier, barcode, localization, nlp, image-recognition, feedback]
    credential: Consumer Key (client_id) + Consumer Secret (client_secret) issued at registration
    request_header: 'Authorization: Bearer <access_token>'
    token_lifetime: 24 hours (default)
    provider_guidance: >-
      "fatsecret requires that OAuth 2.0 tokens be requested through a proxy server" — the secret must
      not ship in a mobile or browser client.
    sources:
      - openapi/_original/fatsecret-platform-openapi.yml
      - https://platform.fatsecret.com/docs/guides/authentication/oauth2
  - name: oauth1
    type: http
    scheme: oauth
    description: OAuth 1.0a request signing; 3-legged for member-scoped data
    signature_methods_documented: true
    scopes: 0
    sources:
      - openapi/_original/fatsecret-platform-openapi.yml
      - https://platform.fatsecret.com/docs/guides/authentication/oauth1/three-legged
    note: >-
      The profile is carried by the access token, not by a user_id parameter. OAuth 1.0a signing
      errors are reported as fatsecret error codes 2-9, not as HTTP 401.
ip_restriction:
  supported: true
  evidence: error code 21, "Invalid IP address detected"
see_also:
  scopes: scopes/fatsecret-scopes.yml
  errors: errors/fatsecret-error-codes.yml
  conventions: conventions/fatsecret-conventions.yml

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this

find_securityBrowse and filter every security artifact in the catalog.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This security artifact

curl "https://apis.io/api/v1/security/fatsecret-authentication"

All security posture

curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.