Getting started
API keys & authentication
Every request authenticates with one header: X-API-Key. There are two kinds of keys.
Key types
| Key | Who | Where to create | Works with |
|---|---|---|---|
fp_live_… | Any free account | Dashboard → Threat API, up to 3 active keys | Threat API |
fp_co_… | Company plans (Starter, Pro, Enterprise, demo) | Company dashboard → Developers | Company API and Threat API |
Company key scopes
Company keys carry scopes. A request without the needed scope returns 403 insufficient_scope.
read: status, cases and the Threat APIsubmit: create cases, including from a Brand Shield finding (Pro and Enterprise)watchlist: read, add and remove monitored domainsfindings: read Brand Shield findingstakedowns: read takedown requests
In the dashboard, Read only creates a key with read; Full access adds all other scopes.
Keep keys safe
- The full key is shown once. We store only a hash, so a lost key cannot be recovered; create a new one.
- Call the API from your server. Never put a key in a browser, mobile app or public repository.
- Use one key per integration and the narrowest scope it needs, so you can revoke one without breaking the others.
- Rotate: create the new key, deploy it, then revoke the old one in the dashboard.