Fillo Authentication

generated: '2026-11-07'
method: searched
source: https://fillo.so/docs/api
sources:
- https://fillo.so/docs/api
- https://fillo.so/docs/security
- openapi/fillo-so-openapi.json
summary:
  types:
  - http
  - oauth2
docs: https://fillo.so/docs/api#auth
schemes:
- name: bearerAuth
  type: http
  scheme: bearer
  description: |
    Project secret keys of the form `fsk_…` (bearer tokens) authenticate every Management
    API call to https://fillo.so/api/v1/manage. Create a key in the dashboard under
    Settings → Connections → API keys, or with `fillo keys create --preset read|agent|full`.
    The plaintext is shown once; Fillo stores only its hash. Keys carry an explicit set
    of scopes — a request for a scope the key lacks returns 403 with a stable message
    naming the missing scope. 401 is returned for missing, malformed, unknown, revoked,
    or expired keys. Management routes are not CORS-open, so a key pasted into browser
    code fails fast; keep `fsk_` keys server-side.
  sources:
  - https://fillo.so/docs/api
  - openapi/fillo-so-openapi.json
- name: oauth2_mcp
  type: oauth2
  flow: authorization_code
  description: |
    The remote MCP server at https://fillo.so/api/mcp is OAuth 2.1 with S256 PKCE and
    RFC 7591 Dynamic Client Registration. Clients discover authorization from
    https://fillo.so/.well-known/oauth-protected-resource. Approving consent on
    fillo.so mints a backing project key that appears in the keys list as
    "MCP: <client>" and can be revoked there at any time.
  sources:
  - https://fillo.so/docs/api
  - https://fillo.so/.well-known/oauth-protected-resource
other_credentials:
- name: publishable_key
  prefix: pk_
  description: Project publishable key — syncs code-defined schemas into one project from client code. Cannot read responses or manage the workspace. Safe in a client bundle; constrained by project allowed-origins.
- name: cli_token
  prefix: fcli_
  description: Private CLI/Zapier token — full management access bound to the minting user and project while workspace owner/admin authority remains. Plaintext shown once; Fillo stores a hash.
- name: identity_secret
  prefix: is_
  description: Server-side HMAC key for signing respondent external IDs and profile fields; protects respondent attribution. Never expose to the browser.
- name: webhook_signing_secret
  description: Per-webhook HMAC-SHA256 secret shown once at creation; used to verify X-Fillo-Signature on each delivery.
- name: sync_token
  description: Stage-only token used by the CLI for code-defined form sync. Returned exactly once by POST /api/v1/manage/sync-tokens.