API Keys

FeedbackJar has two kinds of API keys. Both authenticate the same REST API and MCP endpoints.

Workspace keys (fj_live_)

Scoped to a single workspace. Full access to that workspace only.

Create: Dashboard → Settings → API keys → Create key

Authorization: Bearer fj_live_...

No extra headers needed — the key already knows which workspace to use.

Account keys (fj_user_)

Tied to your user account. You choose which workspaces and permissions each key gets.

Create: Dashboard → Account → API Keys → Create key

Authorization: Bearer fj_user_...
X-Organization-Id: <organizationId>   # required for REST API

The X-Organization-Id header tells the REST API which workspace to operate on. For MCP, this header is optional — see Using account keys with MCP below.

Workspace scoping

When creating a key you can restrict it to specific workspaces. Leave all unchecked for access to every workspace you belong to.

If a key is scoped to specific workspaces, using it with a different X-Organization-Id returns 403.

Permissions

Pick exactly what the key can do, or leave Full access checked to grant everything.

A key with ["*"] has full access (same as a workspace key).

Calling an endpoint the key doesn’t have permission for returns:

{ "error": "Missing permission: posts:write" }

Finding your organization ID

With a workspace key — call GET /api/v1/organization:

curl https://api.feedbackjar.com/api/v1/organization \
  -H "Authorization: Bearer fj_live_..."

With an account key — list all accessible workspaces:

curl https://api.feedbackjar.com/api/v1/organizations \
  -H "Authorization: Bearer fj_user_..."

[
  {
    "id": "cln1abc...",
    "name": "Acme Corp",
    "slug": "acme-corp",
    "role": "owner"
  }
]

Use the id value as X-Organization-Id for REST API calls, or as organization_id in MCP tool calls.

With MCP, you can also ask your agent to call list_organizations — no curl needed.

Security

• Keys are hashed with SHA-256 on creation — the plaintext is shown once and never stored.
• Revoke a key any time from the same settings page where it was created.
• Account keys are limited to 20 per user.
• Both key types are rate-limited to 120 requests per minute.

Using account keys with MCP

Account keys support two MCP config modes:

Multi-workspace (recommended)

One key for all your projects. The agent calls list_organizations to discover workspaces, then passes organization_id to other tools:

{
  "mcpServers": {
    "feedbackjar": {
      "type": "http",
      "url": "https://api.feedbackjar.com/mcp",
      "headers": {
        "Authorization": "Bearer fj_user_..."
      }
    }
  }
}

Single workspace

Pin the session to one workspace — tools behave like a workspace key:

{
  "mcpServers": {
    "feedbackjar": {
      "type": "http",
      "url": "https://api.feedbackjar.com/mcp",
      "headers": {
        "Authorization": "Bearer fj_user_...",
        "X-Organization-Id": "cln1abc..."
      }
    }
  }
}

The MCP server only registers tools the key has permission to call. A read-only key (posts:read, boards:read, tags:read) will only show list_organizations, list_posts, get_post, search_posts, list_boards, and list_tags — write tools won’t appear.

See the MCP Server guide for setup and the MCP Tool Reference for each tool’s parameters.

Try the REST API live in the API Playground.