Authentication
Every request carries a workspace API key. Keep keys on your server.
Send your key in the Authorization header as a bearer token:
curl https://feedbackdots.com/api/v1/projects \
-H "Authorization: Bearer fd_live_..."
Tools that can only set custom headers can send X-API-Key: fd_live_... instead.
Creating and revoking keys
Open Developers in the dashboard. Give each key a name that says where it's used, such as "Zapier" or "Claude Code", so you know which one to revoke later. The full key is shown once; FeedbackDots stores only a hash of it. The list shows each key's first characters and when it was last used.
Revoking a key stops it working straight away. A workspace can have 20 active keys.
Only workspace owners and admins can see, create or revoke keys.
What a key can do
A key acts for the whole workspace: it can read every project, report, comment and feature request, and change them. It can't see billing, members or other workspaces, and it can't delete anything.
Because a key is that powerful, never put it in browser code, a mobile app or a public repository. The widget uses a different, public key (pk_...) that can only send new reports.
The widget key is not an API key
Each project's widget_public_key identifies the project to the widget script. It is safe to publish and cannot read anything. API keys start with fd_live_.