FeedbackJar

API Tokens

FeedbackJar has two kinds of API tokens. Both authenticate the same REST API and MCP endpoints.

Workspace tokens (fj_live_)

Scoped to a single workspace. Full access to that workspace only.

Create: Dashboard → Settings → API Tokens → Create token

bash 
Authorization: Bearer fj_live_...

No extra headers needed — the token already knows which workspace to use.

Account tokens (fj_user_)

Tied to your user account. You choose which workspaces and permissions each token gets.

Create: Dashboard → Account → API Tokens → Create token

bash 
Authorization: Bearer fj_user_...
X-Organization-Id: <organizationId>   # required for REST API

The X-Organization-Id header tells the REST API which workspace to operate on. For MCP, this header is optional — see Using account tokens with MCP below.

Workspace scoping

When creating a token you can restrict it to specific workspaces. Leave all unchecked for access to every workspace you belong to.

If a token is scoped to specific workspaces, using it with a different X-Organization-Id returns 403.

Permissions

Pick exactly what the token can do, or leave Full access checked to grant everything.

PermissionWhat it covers
posts:readGET /posts, GET /posts/:id, GET /posts/search
posts:writeCreate, update, delete, merge posts; update status; set tags
comments:readGET /posts/:id/comments
comments:writeCreate, update, delete comments
boards:readGET /boards, GET /boards/:id
boards:writeCreate, update, delete boards
tags:readGET /tags
tags:writeCreate, update, delete tags
organization:readGET /organization

A token with ["*"] has full access (same as a workspace token).

Calling an endpoint the token doesn’t have permission for returns:

json 
{ "error": "Missing permission: posts:write" }

Finding your organization ID

With a workspace token — call GET /api/v1/organization:

bash 
curl https://api.feedbackjar.com/api/v1/organization \
  -H "Authorization: Bearer fj_live_..."

With an account token — list all accessible workspaces:

bash 
curl https://api.feedbackjar.com/api/v1/organizations \
  -H "Authorization: Bearer fj_user_..."
json 
[
  {
    "id": "cln1abc...",
    "name": "Acme Corp",
    "slug": "acme-corp",
    "role": "owner"
  }
]

Use the id value as X-Organization-Id for REST API calls, or as organization_id in MCP tool calls.

With MCP, you can also ask your agent to call list_organizations — no curl needed.

Security

  • Tokens are hashed with SHA-256 on creation — the plaintext is shown once and never stored.
  • Revoke a token any time from the same settings page where it was created.
  • Account tokens are limited to 20 per user.
  • Both token types are rate-limited to 120 requests per minute.

Using account tokens with MCP

Account tokens support two MCP config modes:

One token for all your projects. The agent calls list_organizations to discover workspaces, then passes organization_id to other tools:

json 
{
  "mcpServers": {
    "feedbackjar": {
      "type": "http",
      "url": "https://api.feedbackjar.com/mcp",
      "headers": {
        "Authorization": "Bearer fj_user_..."
      }
    }
  }
}

Single workspace

Pin the session to one workspace — tools behave like a workspace token:

json 
{
  "mcpServers": {
    "feedbackjar": {
      "type": "http",
      "url": "https://api.feedbackjar.com/mcp",
      "headers": {
        "Authorization": "Bearer fj_user_...",
        "X-Organization-Id": "cln1abc..."
      }
    }
  }
}

The MCP server only registers tools the token has permission to call. A read-only token (posts:read, boards:read, tags:read) will only show list_organizations, list_posts, get_post, search_posts, list_boards, and list_tags — write tools won’t appear.

See the MCP Server guide for setup and the MCP Tool Reference for each tool’s parameters.

Try the REST API live in the API Playground.