Skip to main content
There are four ways to authenticate with Firecrawl. Each one bills the team that owns the credential and gives access to the same features, so the choice depends on who holds the credential and which interface you call.

​
Which should I use?

If your platform creates Firecrawl accounts for its users and pays for their usage, use Firecrawl for Platforms instead.

​
API key

Create a key in the dashboard and send it on every request as Authorization: Bearer fc-YOUR-API-KEY. The SDKs take it as apiKey. A key has full access to the team that owns it, so keep it on your server. See Key restrictions to limit what a key can do.

​
Hosted MCP with an API key

Point your MCP client at https://mcp.firecrawl.dev/v2/mcp and add the API key as a bearer token in the client config. Setup for each client is in Add an API key.

​
MCP OAuth

Point your MCP client at https://mcp.firecrawl.dev/v2/mcp-oauth. The client opens a browser, the user signs in and picks a team, and Firecrawl creates a dedicated key for that connection. The client never sees the key. The native ChatGPT and Claude connectors use this flow automatically. Tokens from this flow work only on the MCP server, not on the REST API. See MCP sign-in.

​
OAuth for apps

Send the user through Firecrawl’s OAuth flow with resource=https://api.firecrawl.dev/. Your app gets an fco_ access token that works on the REST API in place of an API key, plus an fcr_ refresh token.
  • Each connection gets its own key. Your app never sees it, and deleting another key in the dashboard doesn’t affect the connection.
  • The connection is listed under Connected apps in Settings, where the user can revoke it.
  • Refresh tokens rotate and work once. Reusing an old refresh token revokes the whole connection.
The full flow is in OAuth for apps.