API keys
Mint scoped API keys for scripts, BI tools, and integrations, and call the Formtoro REST API.
Formtoro isn't only driven from the admin, it's a fully agentic platform.
For scripts, BI tools, and integrations, you mint API keys — scoped bearer tokens for the Formtoro REST API. Manage them in Settings → API and MCP Connections.
Connecting an AI client like Claude or ChatGPT works differently: it goes through the MCP server, on the same settings page, and needs no key at all.
API keys are part of the AI Insights plan. On other plans the page shows everything in a locked state with an upgrade banner — and if you ever downgrade, existing keys stay visible so you can still revoke them.
Mint a key
- Choose Generate API key.
- Give it a name you'll recognize later (e.g. "BI script" or "Zapier").
- Select the permissions (scopes) it should have — at least one is required, and Analytics is pre-selected as the sensible default.
- Copy the key. This is the only time the key is shown, so store it somewhere safe (a password manager, not a shared doc).
Keys look like ft_live_… and are sent as a bearer token against the REST API:
curl https://public-api.formtoro.com/v1/forms \
-H "Authorization: Bearer ft_live_your_key_here"Manage keys
- Edit permissions changes a key's scopes in place — the key itself never changes, and the new scopes apply from its next request. You can only add scopes your own role holds; scopes already on the key are preserved.
- Revoke permanently disables a key right away. Revoked keys stay listed in a muted state so you have a record of what existed.
- Every mint, permission edit, and revoke is written to your shop's audit trail.
Scopes
Each key is least-privilege — it can only do what you grant, and you can only grant scopes your own role already has. The same permissions govern what an MCP client can do once you approve it:
| Scope | Grants |
|---|---|
| Analytics | Read funnels, step drop-off, engagement, devices, trends, attribution, revenue, discount performance, subscriptions, and A/B results. |
| Customer lifetime value | Read customer-level lifetime value. Grant only to trusted integrations. |
| Form editing | Create and edit forms as drafts. Does not publish or change live forms. |
| Discounts | Read your discount definitions (id, name, status, config). Read-only, no customer data. |
| Branding | Read your themes and confirmed brand (logo, colors, fonts). Read-only, no customer data. |
| Branding editing | Create and edit reusable design artifacts — fork/update themes, create/update shop-level styles. Grant only to trusted integrations. |
The REST API
Everything the scopes above unlock is served from https://public-api.formtoro.com —
forms and funnels, branding and themes, discounts, revenue and attribution, and
shop analytics. The full endpoint-by-endpoint reference, with request and
response shapes, lives in the API reference.
Next steps
- MCP server — connect Claude, ChatGPT, or your own agent instead of writing against the API.
- API reference — every REST endpoint an API key can call.
- Luigi, your AI assistant — the in-app version of the same capabilities.
- Settings & team — roles and permissions, which bound what you can grant.