# Authentication and permissions

> The Authorization Bearer fc_sk_ header, what a key sees, and the list of permissions.

URL : https://docs.fanconvert.ai/en/api/rest/authentification

Every request carries the key in the `Authorization: Bearer fc_sk_…` header. A key:

- belongs to **one person** in the organization, who must be an **admin**;
- only sees **the creators chosen** when it was created (any other answers `404`, as if she did not exist);
- only has **the permissions chosen** (a missing permission answers `403` and names it);
- expires (7, 30 or 90 days) and can be **revoked at any time** in Settings › API & MCP: revocation applies from the next request;
- is the same as the MCP server's: one key system.

Keys created before 7 November 2026 start with `fc_pat_`: they are still accepted.

## REST API permissions [#rest-api-permissions]

| Permission | What it opens |
|---|---|
| `creators:read` | creators |
| `conversations:read` | MYM and OnlyFans conversations and messages |
| `telegram:read` | Telegram conversations and messages |
| `fans:read` | a fan's labels and team note |
| `chatting:read` | who answers a fan (AI, a person, paused) |
| `sales:read` | sales |
| `statistics:read` | statistics per creator |
| `scripts:read` · `media:read` | sales scripts, media library |
| `notifications:read` | emergencies |
| `fans:write` | write the team note and add/remove a label (with `fans:read`) |
| `chatting:write` | pause the AI on a fan, or hand the fan back (with `chatting:read`) |
| `webhooks:read` · `webhooks:write` | list and create [webhooks](/en/api/rest/webhooks) |

**No permission allows sending a message to a fan.**

## Personal data [#personal-data]

The API only returns what the dashboard already shows an admin: fan names, messages, notes. Treat them as personal data: minimal storage, restricted access, deletion when you no longer need them.