Authentication

Every tool is reachable four ways. Pick the one that fits your client:

OAuth and API keys draw on the same account, subscription and call balance.

OAuthCopy Anchor Link

f1ow is an OAuth 2.1 authorization server for the MCP endpoint https://mcp.f1ow.com/mcp. A client that supports MCP authorization needs only that URL. It will:

1. receive a 401 with protected-resource metadata (RFC 9728) pointing at https://www.f1ow.com,
2. read the authorization-server metadata (RFC 8414) and register itself (dynamic client registration, RFC 7591),
3. send you through sign-in and consent (authorization code with PKCE S256),
4. receive a short-lived access token and a rotating refresh token.

You sign in with any method the site supports. Every token maps to the same account. Revoke a client at any time under Connected apps in the dashboard.

API keysCopy Anchor Link

Create keys in the dashboard. A key is shown once; only a hash is stored. Send it as a bearer token:

Authorization: Bearer <your-key>

The same header works on the MCP endpoint https://mcp.f1ow.com/, the REST API and the WebSocket handshake. An OAuth access token works in its place on all three.

Use one key per client or bot, so each has its own usage history and you can revoke one without touching the others.

Key in pathCopy Anchor Link

Some clients can only take a URL. Put the key in the path instead:

https://mcp.f1ow.com/key/<your-key>          MCP
https://mcp.f1ow.com/key/<your-key>/v1       REST
wss://mcp.f1ow.com/key/<your-key>/v1/ws      WebSocket

The URL is now a credential. Don't paste it anywhere you wouldn't paste the key.

x402Copy Anchor Link

x402 lets an agent pay per call over HTTP, with no account, key or subscription. f1ow accepts USDC on Base.

The payment exchange depends on the transport:

• REST: call a priced resource under https://mcp.f1ow.com/x402/v1. The server answers HTTP 402 Payment Required with a base64 PAYMENT-REQUIRED header describing the price, asset and pay-to address. Sign the payment and retry with a PAYMENT-SIGNATURE header. A successful paid response includes a base64 PAYMENT-RESPONSE receipt header.
• MCP: call a priced tool at https://mcp.f1ow.com/x402. The server answers HTTP 200 with a JSON-RPC tool result whose isError is true; the payment challenge is in structuredContent and JSON text in content. Sign the payment and retry the tool call with the payment object in params._meta["x402/payment"]. A successful paid result carries its receipt in result._meta["x402/payment-response"]. The MCP endpoint also supports the same payment headers as REST.

The server runs the tool before settling and does not settle a failed tool call. Use an x402 client that supports your chosen transport to automate the exchange. Prices per call:

WebSocket is not available over x402. For sustained use, a subscription is far cheaper per call. See pricing & limits.

ErrorsCopy Anchor Link

REST errors are RFC 9457 problem details. MCP payment challenges and metered-usage denials are HTTP 200 tool results with isError: true, not HTTP 402 responses.

For agents: this page as Markdown · all docs