Fullcontact Authentication

generated: '2026-08-14'
method: searched
source: openapi/fullcontact-openapi.yml
docs: https://docs.fullcontact.com/docs/generate-an-api-key
description: >-
  One credential covers everything FullContact exposes: the V3 REST API and the
  hosted MCP server both authenticate with the same API key, sent as an HTTP
  Bearer token. There is no OAuth, no OIDC, no separate MCP credential, and no
  scope surface — entitlements are attached to the key by FullContact's account
  team rather than requested by the client.
summary:
  types:
  - http
  api_key_in:
  - header
  oauth2_flows: []
schemes:
- name: bearerAuth
  type: http
  scheme: bearer
  description: FullContact API key passed as a Bearer token in the Authorization header.
  header: Authorization
  format: 'Bearer <your-fullcontact-api-key>'
  sources:
  - openapi/fullcontact-openapi.yml
  - https://docs.fullcontact.com/docs/authentication

key_management:
  provisioning: https://docs.fullcontact.com/docs/generate-an-api-key
  console: https://platform.fullcontact.com
  key_types:
    - {type: production, note: required for production traffic}
    - {type: sandbox, note: '"accepted for evaluation only"'}
  entitlements: >-
    Products are entitled per key by FullContact, not requested per call. A key
    must have person.enrich enabled to use the MCP server; a key without it
    receives 403 forbidden and the fix is to contact the FullContact account
    team.
  rotation: >-
    Generate a new key in the developer dashboard, update every client, then
    revoke the old key. FullContact holds no server-side cache of the key, so
    the next request uses the new value immediately.
  multi_client: >-
    A single key can be used across multiple clients simultaneously; all calls
    count against the same rate limit and quota.

mcp:
  endpoint: https://api.fullcontact.com/v3/mcp
  scheme: same Bearer API key
  oauth: false
  docs: https://docs.fullcontact.com/docs/authentication
  note: >-
    "There is no separate MCP credential, no OAuth flow, and no need to
    provision new accounts."

failure_modes:
  - {status: 401, code: unauthorized, cause: Missing or malformed Authorization header, surface: mcp}
  - {status: 403, code: forbidden, cause: Key lacks the person.enrich entitlement, surface: mcp}
  - {status: 403, cause: 'API key invalid, missing, or over quota / rate-limit', surface: rest}

not_published:
  - OAuth 2.0 or OpenID Connect flows
  - scopes / permission strings (see conformance — no OAuthScopes artifact is emitted)
  - mTLS
  - key prefixes that distinguish sandbox from production
  - '/.well-known/oauth-authorization-server or /.well-known/oauth-protected-resource (both 404)'

x-evidence:
  - fetched: '2026-08-14'
    url: https://docs.fullcontact.com/docs/authentication.md
    http_status: 200
  - fetched: '2026-08-14'
    url: https://api.fullcontact.com/.well-known/oauth-authorization-server
    http_status: 404