05 — Integrations · API Keys
Keys for plugins and AI.
API keys are how the WordPress plugin and the MCP server talk to your account. They have a deliberately narrow scope — they cannot read your messages, change your password, or touch your billing.
Creating a key
- Open Settings → API Keys in the dashboard.
- Click Create key.
- Give it a label so you can recognise it later (e.g. "WordPress — example.com" or "Claude Desktop").
- Copy the key. It starts with
fp_and is shown only once — there's no way to retrieve it later.
!
If you lose a key, revoke it and create a new one. We don't store the plain-text value, only a hash, so the dashboard genuinely can't show it to you again.
What a key can do
- Create, edit, and delete tokens
- Read and update form-builder configurations
- Fetch embed codes (script tag, iframe, shortcode, direct URL)
- Read account-level info (plan, language)
What a key cannot do
- Read submission contents
- Change your password or 2FA
- Manage billing, subscriptions, or invoices
- Manage sessions or revoke devices
- Manage other API keys (you can only do that from a real logged-in dashboard session)
- Send mobile push notifications
i
This narrow scope is on purpose. Even if a key leaks, the worst-case damage is bounded: someone could create or delete forms, but they couldn't read existing submissions or take over your account.
Limits
- Maximum 5 active keys per account. Plenty for one WordPress site, two MCP clients, and a spare.
- Keys never expire automatically — rotate them on your own schedule.
Using a key
Send the key in the X-API-Key header (for direct REST calls) or as a Bearer
token (for the MCP server). Both work.
curl https://api.formping.ch/api/tokens \
-H "X-API-Key: fp_YOUR_KEY_HERE"Rotating a key
- Create a new key with a fresh label.
- Update your WordPress plugin / MCP client config with the new key.
- Verify everything still works.
- Revoke the old key from the dashboard.
Security tips
- Generate a separate key per integration. If one device is compromised, you only revoke that one.
- Never commit keys to a Git repo. Use environment variables.
- Rotate after personnel changes (an employee leaving, a device being lost).
- Watch the last used column in the dashboard — keys you haven't seen activity from in a while are good rotation candidates.
- Revoke immediately if you suspect a leak. Revocation is instant.