Create an API key

API keys are how servers, scripts, and Claude Code authenticate — a static bearer token, no browser flow. You generate them from the Forktime dashboard and choose exactly which brands and capabilities each key can touch.

Generate a key

1. Sign in to the dashboard at app.forktime.ai.
2. Open API keys (under Settings / Developer).
3. Click Create key and give it a recognisable name (e.g. “Ordering bot — Medusa”).
4. Choose the brands this key may access.
5. Choose the scopes — the exact read/write capabilities it’s allowed. Grant the least it needs.
6. Click Create, then copy the key — it’s shown once.

A key looks like:

gfk_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Copy it now

Only a prefix and a hash are stored on our side — the full key is shown a single time at creation and can never be retrieved again. If you lose it, revoke it and create a new one. Treat it like a password: never commit it to source control.

Use the key

Send it as a bearer token on every request to the MCP endpoint:

POST https://api.forktime.ai/mcp
Authorization: Bearer gfk_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Most MCP clients take this as a header. For Claude Code:

claude mcp add --transport http forktime https://api.forktime.ai/mcp \
  --header "Authorization: Bearer gfk_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"

Then confirm it works by calling list_brands — it should return the brands the key can access.

Good practice

• One key per integration. Separate keys for separate apps make revocation surgical.
• Least privilege. If an integration only reads the menu, give it menu.read and nothing else.
• Rotate on suspicion. Revoke and re-issue if a key may have leaked; the old one stops working immediately.
• live vs test. Production keys are prefixed gfk_live_; non-production environments issue gfk_test_.

Prefer a browser sign-in for an interactive client like claude.ai or Cursor? Use OAuth instead — see Connect a client.