Authentication

Every /api/v1/* request is authenticated by a Credential — a secret tied to exactly one Site.

The header

Authorization: Bearer <YOUR_FEEDCENTRAL_API_TOKEN>

There is no other authentication mechanism for the customer API — no API-key query parameter, no cookie, no separate signing scheme.

Creating a Credential

Credentials are created from the dashboard, not the API:

1. Sign in to the dashboard.
2. Select (or create) a Customer, then a Site.
3. Open API Credentials for that Site and choose Create Credential.
4. Pick the scope(s) the Credential needs (see API Keys & Scopes).
5. The plaintext secret is shown exactly once, at creation time. Copy it immediately.

The secret is shown once

FeedCentral never stores your Credential's plaintext secret — only a one-way hash. If you lose the secret, there is no way to recover it: revoke the Credential and issue a new one.

Revocation

Revoke a Credential from the dashboard at any time. Revocation is immediate — the very next request using that secret is rejected with 401 UNAUTHENTICATED.

Expiry

A Credential may optionally be given an expiry date at creation time. Most Credentials don't need one — omit it for a Credential that should keep working indefinitely (until you revoke it yourself).

Last used

The dashboard shows when a Credential was last successfully used, so you can spot stale or unused keys.

Rotating a Credential

There's no separate "rotate" operation — rotation is just:

1. Issue a new Credential with the same scopes.
2. Verify the new secret works in your integration.
3. Revoke the old Credential.

The dashboard's "Rotate" action on an existing Credential walks you through exactly this flow.

Failure responses

See Errors for the full reference.