# Fliinow authentication and access

## Public MCP

The Fliinow MCP server requires no login and exposes only public information, installment estimates and published articles. It does not act as a partner or access account records. No OAuth scopes or tokens are required for these tools.

[MCP access and tools](https://fliinow.com/agents.md)

## Partner API authentication

The separate Fliinow Partner API uses an API key in the `X-Fliinow-API-Key` header, as documented by the official integration portal. Obtain credentials through Fliinow's partner onboarding; never place private API keys in browser code, public repositories or tool outputs.

- Sandbox API base: `https://demo.fliinow.com/integration-api/v1`.
- Production API base: `https://app.fliinow.com/integration-api/v1`.
- Sandbox keys have the prefix `fk_test_`; production keys have the prefix `fk_live_`.
- Agency keys operate for their agency.
- Management group keys must send `X-Fliinow-Agency` with the agency ID on every endpoint except `GET /agencies`, according to the official documentation.

API-key access is not OAuth. This site does not declare an OAuth authorization server for the partner API.

## Errors and safe operation

The API reference documents HTTP 401 for missing or invalid credentials, with `error_description`; HTTP 500 with `errorCode: INTERNAL_ERROR`; and HTTP 422 with `errorCode: DATA_INTEGRITY_ERROR`. Consult endpoint-specific documentation for other errors.

Never retry a state-changing operation blindly. Notifications are not signed according to the current API reference; verify the operation's actual status through the authenticated API before acting on a webhook.

## Authoritative references

- [Authentication](https://api.docs.fliinow.com/authentication)
- [API reference](https://api.docs.fliinow.com/api-reference)
- [Error handling](https://api.docs.fliinow.com/errors)
- [Best practices](https://api.docs.fliinow.com/best-practices)
- [Partner support](https://api.docs.fliinow.com/support)