Security

A key looks like fk_live_… (there is a single prefix and no test keys) and is shown once, when an administrator creates it in the API and MCP settings of the app (Ajustes → API y MCP); Filmo keeps only a hash of it. It acts with the authority of that administrator, and everything it writes is attributed to them. Anyone who holds the key can do what its scopes allow.

• Store it in a secret manager or in your platform's encrypted environment variables, and read it at run time as FILMO_API_KEY.
• Never put it in source code, in a front-end bundle, in a mobile app or in a URL. Call the API from your server.
• Do not send it by email or chat. Pass it to a teammate through the shared secret manager.
• Keep it out of logs, error reports and screenshots. Redact the Authorization header.
• Use a different key for each integration and each environment, so you can revoke one without breaking the rest.

Give each key only the scopes its integration uses. A read-only integration needs only read scopes. The first call of any integration, GET /api/v1/account, needs account:read. See the scopes and permissions pages. For AI assistants, prefer read-only scopes and approve writes one at a time.

1. 1

   Create a new key

   In the API and MCP settings, create a key with the same scopes. Name it so you can tell it from the old one.

2. 2

   Deploy it

   Put the new key in your secret store and deploy. Check that requests succeed with it.

3. 3

   Revoke the old key

   Revoke it in the same screen. Requests that still use it start answering 401 api_key_revoked.

A key can have an expiry date, chosen when it is created, and then requests answer 401 api_key_expired after that date. A key without a date never expires, not even when it goes unused. Treat both codes as the signal to issue a new key. Several keys can be active at once (up to 50 keys that are not revoked per subscription; expired keys count, and so do OAuth connections), so you can overlap the new key and the old one. Rotate on a schedule that fits your policy, and always when someone who knew the key leaves your team.

Act first, investigate second. Revoking a key cuts off access instantly.

1. 1

   Revoke the key now

   Open the API and MCP settings of the app and revoke it. An administrator is needed. Do this before anything else.

2. 2

   Create a replacement

   Create a new key with the least scopes the integration needs, store it in your secret manager and deploy it.

3. 3

   Remove the key from where it leaked

   Delete it from the repository, the log, the chat or the page. Remember that deleting a commit does not remove it from the history or from forks, so assume the old key is public and keep it revoked.

4. 4

   Check what happened

   Review recent changes in the app for records you do not recognize. Everything the key wrote is attributed to the administrator who owns it. If your account has the activity log, which is an add-on, it marks the changes that came from the API; without it, compare the records with your own.

5. 5

   Tell support if data may have been accessed

   Include the approximate time of the leak and, if you have them, the request ids of suspicious calls.

Each MCP client page links back here. For help, see support, and the help-center articles on security and active sessions.

The most common way a key leaks is a configuration file that is committed. MCP clients keep server definitions in files such as .mcp.json (Claude Code), .cursor/mcp.json (Cursor) and .vscode/mcp.json (VS Code), and these files are usually in the repository.

• Do not write the key into these files. Use the client's support for environment variables, so the file holds a reference such as ${FILMO_API_KEY} and the value lives in your shell or secret store. The syntax differs between clients: check the page for yours.
• If the file must hold a secret, add it to .gitignore before the first commit.
• Add a secret scanner to your repository and to your CI, and check the history if a file was committed once.

{
  "mcpServers": {
    "filmo": {
      "type": "http",
      "url": "https://app.filmo.io/api/v1/mcp",
      "headers": {
        "Authorization": "Bearer ${FILMO_API_KEY}"
      }
    }
  }
}

OAuth is not a second system: the token it issues is a short-lived API key. Details are in OAuth and MCP authentication. The administrator who approves a connection will find what to check in MCP for administrators.

If you think you have found a security problem in the API or the documentation, write to contact@filmo.io and describe it without real customer data. The same contact is published in the security.txt file at https://www.filmo.io/.well-known/security.txt and at https://docs.filmo.io/.well-known/security.txt. Do not test against accounts that are not yours, and do not publish the problem before Filmo has had the chance to answer.