Connect the API, MCP, and webhooks
The API, MCP, and dashboard operate on the same account. Pick the interface that fits the job.
Use the API for direct application calls
Create a named API key in API & MCP settings. Copy its secret when it is shown; later listings show the key’s metadata, not the secret. Keep it on your server or in a secret store, and revoke it when an integration no longer needs access.
Send the key as a Bearer credential. Creation requests for monitors and webhook endpoints also need an Idempotency-Key. Reuse the same key for a retry of the same request after a network failure; generate a new key for a new action.
curl "$FAREFLARE_ORIGIN/v1/monitors" \
-H "Authorization: Bearer $FAREFLARE_API_KEY"Use MCP for an assistant or compatible client
The hosted MCP address is this site’s origin followed by /mcp. Clients that support OAuth can discover the authorization server, ask you to sign in, and request explicit consent. PKCE protects the authorization exchange. Review the requested client before approving it.
For a client that supports custom request headers, a customer API key can also be sent as a Bearer credential. OAuth access tokens are scoped to MCP; they are not REST API keys. Connected applications can be revoked from your account settings.
Use webhooks when a change should trigger work
Register an HTTPS endpoint you control and complete the ownership verification before using it as an alert destination. Keep the signing secret private. Your receiver should verify the Standard Webhooks signature against the raw request body before processing an event.
Delivery is at least once. Deduplicate by the event ID, make processing idempotent, and return success only after accepting the event durably. A temporary failure can be retried; repeated failures remain visible for investigation and retry.
A monitor explicitly routed to a webhook does not silently fall back to Telegram. Choose the destination deliberately and inspect delivery history when debugging.
Treat observations as observations
Prices are integer minor units in the API: USD 123.45 is 12345. Use the currency and observation timestamp together, follow pagination cursors, and respect Retry-After responses instead of repeatedly retrying a busy service.
API access does not remove collection limits or make a stored observation live. Build the age of the quote and any collection failure into your own interface. No payment credentials are required.