Skip to main content
FirstTouch Public API requests use a permanent user-scoped API key in the X-API-Key request header. Like MCP authorization, each key also belongs to the FirstTouch team selected when it is created.
API keys are credentials. Never place a real key in source control, browser code, screenshots, prompts, support messages, or application logs.

​
Create A Key

Create and save a named key from Settings > MCP & API, then load it from your server-side secret store and send it as X-API-Key on every request.

Manage Public API Keys

Follow the web-app steps for creation, one-time secret storage, rotation, revocation, and key history.
The MCP & API tab follows the existing paid or free-trial MCP feature visibility. Every active team member can create and manage their own keys. Users cannot see, rotate, or revoke another user’s keys, including when they are a team owner, team admin, or FirstTouch system administrator. Key management is unavailable while a system administrator is impersonating another user.

​
Key Scope

Each key is bound to:
  • The user who created it.
  • The team selected when the key was created.
  • The creator’s current permissions, ownership, feature access, sender access, billing state, and team membership.
Requests stop working if the key is revoked, the creator becomes inactive, or the creator no longer belongs to the team. Changing teams in the web app does not change an existing key’s team.

​
Lifetime

Public API keys do not expire automatically. They remain active until rotated or revoked. Use separate named keys for separate integrations and environments so one credential can be replaced without interrupting every integration.

​
Rotate A Key

Rotating a key:
  1. Invalidates the previous secret immediately.
  2. Creates a new secret for the same named key.
  3. Displays the replacement secret once.
Update the integration’s secrets manager before its next request. Only the user who created the key can rotate it.

​
Revoke A Key

Revoking a key permanently blocks future requests using that secret. Revoked keys remain visible in the settings history but cannot be rotated or reused.

​
Use With MCP

The same X-API-Key credential can authenticate FirstTouch MCP when the MCP client supports custom HTTP headers. Configure the FirstTouch MCP server URL and add:
Browser OAuth remains the recommended setup for interactive MCP clients because it guides the user through sign-in and team approval. See Connect FirstTouch MCP for both options.

​
Security Checklist

  • Store keys only in a server-side secrets manager.
  • Use one key per integration and environment.
  • Never send a key to an unrelated domain.
  • Do not expose keys through client-side environment variables.
  • Rotate a key immediately if it may have been copied or logged.
  • Revoke keys for retired integrations.
  • Review the Last used value to identify unused credentials.