Authenticating with an API key

Create a key, send it as a bearer token, rotate it safely. Where keys live, what they can do, and what to do if one leaks.

The REST API starts on Growth. It is not available on Starter, and it is one of the few things a tier actually decides — along with the MCP server, webhooks and scheduled exports, which switch on at the same point. The free trial includes it, because the trial has everything unlocked. Keys are created in Account → Security → Access keys.

What a key can reach does not vary by tier. A Growth key and an Enterprise key can search the same markets, the same 4,000+ categories and the same geographies; they differ in requests per second and in how many credits sit behind them.

Creating a key

Press New key, give it a name that says where it will be used ("n8n production", "laptop scratch"), and copy the value. Keys look like this:

# the only time the full value is ever shown
fac_live_7Kq2mZ4tR8wN1cX6bV0sJhD3fG9pL5yA

The full key is shown once

After you close the dialog the app only ever shows the prefix and the last four characters. If you lose it, delete the key and make a new one — there is no recovery, by design.

Sending it

Bearer token, on every request:

curl https://api.findandclose.com/api/v1/me/credits \
  -H "Authorization: Bearer fac_live_7Kq2mZ4t…"

# -> 200
{ "remaining": 48210, "quota": 50000,
  "rolled_over": 3120, "rollover_expires_at": "2026-09-12T00:00:00Z",
  "resets_at": "2026-08-12T00:00:00Z", "plan": "growth" }

Base path is /api/v1. JSON in, JSON out. Session tokens from the web app and fac_live_ keys both resolve to the same user, so a key can do anything you can do in the browser — including spending credits.

What a key can and cannot do

Can search, create exports, download files, read credits and invoices.
Cannot exceed your plan's credits. An agent or a script cannot spend more than you could.
Cannot see unmasked contact data through the search endpoint. Masking is enforced server-side — why previews are masked.

Errors you will meet first

HTTP	Code	Usually means
401	`unauthenticated`	Missing, malformed or deleted key. Check for a stray newline in the header.
403	`forbidden`	Valid key, but the account is not allowed to do that — most often a Starter account, which does not include the API at all.
429	`rate_limited`	Too many requests per second — see rate limits
402	`credits_exhausted`	Out of credits. Read endpoints still work.

Errors always arrive in the same shape, never as a bare string:

{ "error": { "code": "credits_exhausted",
            "message": "…", "details": {} } }

Rotating and revoking

Create the new key first, deploy it, then delete the old one. Deletion takes effect immediately — there is no grace period, so do it in that order. Delete a key the moment it is no longer needed; unused keys are the ones that leak.

If a key has leaked, delete it now and check Account → Exports for jobs you did not create. Anything created with the leaked key is on your credit balance, so tell us at support@findandclose.com and we will look at what it did.

Keeping keys out of your repository

Environment variable, secret manager, or your CI's secret store — never a committed file, never a front-end bundle. A fac_live_ key in browser JavaScript is public.

Next: the search endpoint · exports, rate limits and pagination

Updated on: 22/07/2026