> ## Documentation Index
> Fetch the complete documentation index at: https://docs.firecrawl.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Choose between API keys, hosted MCP and OAuth for calling Firecrawl

There are four ways to authenticate with Firecrawl. Each one bills the team that owns the credential and gives access to the same features, so the choice depends on who holds the credential and which interface you call.

## Which should I use?

| You are building | Use | Endpoint | Credential | How it ends |
| - | - | - | - | - |
| Your own code calling the REST API for your team | [API key](#api-key) | `https://api.firecrawl.dev/v2/...` | `Authorization: Bearer fc-...` | Delete the key in [API keys](https://www.firecrawl.dev/app/api-keys). |
| An MCP client you configure yourself | [Hosted MCP with an API key](#hosted-mcp-with-an-api-key) | `https://mcp.firecrawl.dev/v2/mcp` | `Authorization: Bearer fc-...` header in the client config | Delete the key. |
| A connector such as ChatGPT or Claude, or an MCP client with browser sign-in | [MCP OAuth](#mcp-oauth) | `https://mcp.firecrawl.dev/v2/mcp-oauth` | Handled by the client. Each connection gets its own key. | Revoke it under [Connected apps in Settings](https://www.firecrawl.dev/app/settings?tab=mcp). |
| An app where each user connects their own Firecrawl account | [OAuth for apps](#oauth-for-apps) | `https://api.firecrawl.dev/v2/...` | `Authorization: Bearer fco_...` access token. Each connection gets its own key. | Your app revokes it, or the user revokes it under Connected apps. |

If your platform creates Firecrawl accounts for its users and pays for their usage, use [Firecrawl for Platforms](https://docs.firecrawl.dev/firecrawl-for-platforms.md) instead.

## API key

Create a key in the [dashboard](https://www.firecrawl.dev/app/api-keys) and send it on every request as `Authorization: Bearer fc-YOUR-API-KEY`. The SDKs take it as `apiKey`. A key has full access to the team that owns it, so keep it on your server. See [Key restrictions](https://docs.firecrawl.dev/features/key-restrictions.md) to limit what a key can do.

## Hosted MCP with an API key

Point your MCP client at `https://mcp.firecrawl.dev/v2/mcp` and add the API key as a bearer token in the client config. Setup for each client is in [Add an API key](https://docs.firecrawl.dev/mcp-server/keyless.md#add-an-api-key).

## MCP OAuth

Point your MCP client at `https://mcp.firecrawl.dev/v2/mcp-oauth`. The client opens a browser, the user signs in and picks a team, and Firecrawl creates a dedicated key for that connection. The client never sees the key. The native ChatGPT and Claude connectors use this flow automatically. Tokens from this flow work only on the MCP server, not on the REST API. See [MCP sign-in](https://docs.firecrawl.dev/mcp-server/oauth.md).

## OAuth for apps

Send the user through Firecrawl's OAuth flow with `resource=https://api.firecrawl.dev/`. Your app gets an `fco_` access token that works on the REST API in place of an API key, plus an `fcr_` refresh token.

* Each connection gets its own key. Your app never sees it, and deleting another key in the dashboard doesn't affect the connection.
* The connection is listed under [Connected apps in Settings](https://www.firecrawl.dev/app/settings?tab=mcp), where the user can revoke it.
* Refresh tokens rotate and work once. Reusing an old refresh token revokes the whole connection.

The full flow is in [OAuth for apps](https://docs.firecrawl.dev/oauth.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.