API keys

An API key lets a script, a CI job or an AI app use Fload without anyone signing in, through the remote MCP server or the local MCP server. You decide what each key can do and when it stops working.

Connecting Claude, Cursor or ChatGPT? You don't need a key. Sign in through the remote server instead: Connect via MCP.

Create a key

1
Open Connect (MCP)
In Fload, Settings › Connect (MCP), then Advanced: local clients (npx + API key).
2
Name it
Click Create Key and give it a name you'll recognize, like “Nightly report script”.
3
Choose what it can do
One of the four options below, or Custom to pick each permission.
4
Set an expiry
30 days, 90 days (the default), 1 year or never.
5
Copy it
Click Create and copy the key. You won't see it again.

A key never does more than your own role in the organization allows.

What a key can do

Read onlyThe default. Reads apps, your team and share links, reviews, analytics, ASO, Apple Ads and agents. Changes nothing.
Read and propose changesAlso puts ASO and Apple Ads changes in your inbox for someone to approve.
Full access, including approvalsAlso approves inbox items, sends review replies, runs agents and chats with Fio.
CustomPick each permission yourself, from the list below.

Each permission

Permission	What it allows
Read apps	See your apps, their details and your usage.
Read team and share links	See your organization's members and pending invitations, with their email addresses, and your apps' share links. A key without it can't see your team.
Read reviews	Read your app reviews and the replies to them.
Read analytics	Read metrics, downloads, dashboards and reports.
Read ASO	Read keywords, rankings, listing suggestions and experiments.
Read Apple Ads	Read ad campaigns, keywords and results. This also covers Google Ads, Meta Ads and TikTok Ads campaigns you've connected.
Read agents and inbox	Read agents, their runs, the inbox and the journal.
Propose ASO changes	Track keywords, and put listing changes and experiments in your inbox.
Propose Apple Ads changes	Put campaign pauses, bid changes and negative keywords in your inbox.
Reply to reviews	Draft, translate and analyze review replies (uses credits).
Approve and run	Approve or reject inbox items, run or pause agents, and create tasks and reports (uses credits).
Chat with Fio	Send messages to Fio and save notes to its memory.

Approvals need two permissions

Approve and run on its own isn't enough to act on a change. Approving or rejecting an item also needs the permission for that area:

To approve or reject	The key needs
A listing change or experiment	Approve and run + Propose ASO changes
An Apple Ads change	Approve and run + Propose Apple Ads changes
A review reply	Approve and run + Reply to reviews
A note or a question from an agent	Approve and run

The same goes for review replies outside the inbox. Sending a reply, or editing or deleting one that's already approved, needs both Reply to reviews and Approve and run. If a permission is missing, Fload says which one.

Stopping a scheduled change only needs Approve and run.

Chat over a key

Chat with Fio lets a key send messages to Fio. Fio then only uses the tools the key's other permissions allow. A Read only key plus Chat with Fio can ask questions, but Fio can't put anything in your inbox for it.

Safe retries

A script can send a retry key with an approval, an inbox command or a new task. If it sends the same retry key again, for example after a timeout, Fload answers with the first result and doesn't act twice. Without one, every call runs again.

What a key can't do

Some things always need a person:

Apply changes straight away. A change asked for with a key always goes to the inbox first.
Ask for the Ads Agent. Ask from the Ads page in Fload, or from an AI app you signed in to yourself.
Turn an agent on. Use the Fload app, or an AI app you've signed in to.
Let an agent act on its own, such as ASO auto mode, weekly promotional text or the Review Agent's Auto-mode. Only a person signed in to Fload can turn these on. Anyone can turn them off.
Approve publishing screenshots or custom product pages, or translate header and search art and put it on your store pages.
Change the Review Agent's settings.
Edit, retry or snooze an inbox task. A key can approve, reject, dismiss, acknowledge or check a task again; the rest happens in Fload.

Using a key

With the remote MCP server, send the key as a header to https://api.fload.com/mcp:

text

Authorization: Bearer fload_sk_your_key_here

The key works in its own organization only, as the person who made it, with the key's permissions. If that person's role can no longer make changes, neither can the key. Tool names from the local server still work there for now.

With the local MCP server:

json

{
  "mcpServers": {
    "fload": {
      "command": "npx",
      "args": ["-y", "@fload-ai/mcp"],
      "env": {
        "FLOAD_API_KEY": "fload_sk_your_key_here"
      }
    }
  }
}

See Local MCP server for the full setup and tool list.

Keep keys safe

Fload stores only a hashed copy of each key. The list shows a key's name and the first few characters so you can tell them apart.
A key belongs to one organization.
Give scripts and CI jobs Read only unless they need more, and set an expiry.
An expired key stops working. Create a new one.

Revoke a key

Go to Settings → Connect (MCP), find the key in Your API Keys and click revoke. It stops working at once. Revoked keys stay listed under Revoked keys and can't be turned back on.

API keys

Create a key

Open Connect (MCP)

Name it

Choose what it can do

Set an expiry

Copy it