API authentication

REST base URL: https://apifleet.dev. Resource routes are at the root, such as /assistants; there is no /api/v1 prefix. The MCP server is https://apifleet.dev/mcp. Both use Authorization: Bearer <APIFleet workspace API key>.

Create a key at https://apifleet.dev/app/api-keys. It starts with af_live_, is shown once and is stored as a SHA-256 hash. Revoked keys cannot authenticate. Current keys have full management access to their workspace, including permission to create additional workspace keys; APIFleet does not currently offer a read-only or signup-only key scope. Keep the key in server-side environment variables or your MCP client's private settings, not in public browser code.

The dashboard uses Google/email sign-in and a session cookie. MCP always requires the Bearer key and ignores dashboard cookies. The workspace is resolved from the key; you do not supply a tenant ID or choose another user's workspace. MCP does not currently provide an OAuth authorization server, refresh tokens or connected-app grants. Dashboard Google OAuth is not MCP OAuth.

Repeated invalid credentials are throttled by source IP, with a Retry-After response header. Valid credentials are resolved before that failure block. There is no documented general 300-requests/minute allowance or subscription quota; do not assume another product's limits apply. REST and MCP use the same native workspace/resource checks. A full key remains a full key even if an agent chooses only read tools.

Request bodies are JSON with Content-Type: application/json. The server request-body limit is 1 MiB; individual resources have tighter validation limits. Timestamps are ISO 8601; phone numbers use E.164. Currency fields ending in microusd are integer millionths of USD.

First read:

curl https://apifleet.dev/assistants \
  -H "Authorization: Bearer $APIFLEET_API_KEY"