Authentication
Organization-scoped API keys, OAuth, and scopes.
Every partner call authenticates as an App scoped to one Organization. Keys never cross tenants.
Secret API keys
Server-to-server. Send the secret as a bearer token.
Authorization: Bearer fb_live_4e8c…| Prefix | Mode |
|---|---|
fb_live_ | Production data |
fb_test_ | Test mode |
The Server SDK takes the secret in its constructor. Do not send a secret key from a browser or a mobile app.
Rotate a key from Developers → Apps → Keys. The old secret stops working immediately. Issue the replacement first, deploy, then revoke.
Publishable keys
The Capture SDK uses a publishable key (fb_pk_live_… / fb_pk_test_…). It can open and embed surveys. It cannot list responses, manage stations, or read webhook secrets.
OAuth 2.0
When an App acts on a signed-in user's organization, use OAuth 2.0. FeedByte is the authorization server.
- Authorization and token endpoints are advertised at
https://api.feedbyte.io/.well-known/oauth-authorization-server. - The user signs in at
https://feedbyte.io/sign-inand consents athttps://feedbyte.io/oauth/consent. - MCP clients can register dynamically. Dashboard-registered Apps use the client id issued when you create the App.
Request only the scopes you need. The access token is bound to the user's active organization.
Scopes
| Scope | Grants |
|---|---|
survey:read | List and fetch surveys |
survey:write | Create, update, publish, archive surveys |
link:read | Fetch a Capture link |
link:write | Create Capture links with metadata |
response:read | Get, list, search, and export responses |
webhook:manage | Register and rotate webhook endpoints |
survey:analytics:read | Aggregated analytics, including MCP tools |
API keys carry the App's granted scopes. OAuth access tokens carry the scopes the user consented to.
MCP clients request survey:analytics:read (plus openid, profile, email, offline_access). See MCP.