Create an API key
Create a key so another program can read or change your Filmo data, choose what it may do and keep it safe.
Account administrators (the roles «Superadministrador», «Administrador» and «Propietario» in the Spanish app). Other people do not see the API and MCP page of Settings.
Screen and button names are given in English as a guide. The first time, the name shown in the Spanish app is in brackets.
An API key is a long secret code that lets another program, or a tool such as Make, n8n or Zapier, read and change your Filmo data without anyone signing in. Each key carries permissions that say exactly what it may do.
Before you start
- Decide what the key is for and give one key to each tool, so you can switch off one without affecting the others.
- Know which data it needs. You will choose its permissions while creating it, and you cannot change them afterwards.
- The API is included in every paid plan; it is not a separate module. You can also try it during the free trial.
- Be ready to store the key in a password manager: Filmo shows it only once.
Create the key
- Open the API and MCP page of Settings. Use your user menu in the sidebar to open Settings («Configuración»), then choose «API y MCP» in the platform settings. Open the tab for API keys («Claves de API»).
- Choose the button to create an API key («Crear clave de API»).
- Type a name («Nombre»). Pick one that says what will use the key, such as “Accounting sync”. It can have up to 80 characters.
- Tick its permissions («Permisos (scopes)»). Nothing comes ticked: tick only what the integration needs, and at least one. Add «account:read» so the key can identify itself. See API permissions (scopes).
- Optionally set an expiry date («Fecha de expiración»). The key stops working at the end of that day, in your time zone. Without a date it works until you revoke it.
- Choose «Crear».
- Copy the key and keep it safe. Use the copy button («Copiar») and store the key in a password manager. Filmo shows it only this once. Then choose «He guardado la clave».
Treat the key like a password
Whoever has the key can read and change your data with its permissions. Never send it by email or chat, and never paste it into a document others can open. If you think it leaked, revoke it right away.
Hand the key to whoever builds the integration
The integration sends the key in the Authorization header of every request. A good first test, which only reads the account's basic settings, is:
curl https://app.filmo.io/api/v1/account \ -H "Authorization: Bearer $FILMO_API_KEY"
The step-by-step guide for developers, with examples in many languages, is the quickstart; before going live with real data, read the go-live checklist.
Manage your keys
The tab for API keys lists every credential of the account: the keys you create and the AI assistants connected to it, newest first. Each row shows the name, the status (active, expired or revoked), the start of the key (fk_live_…), when it was last used, when it expires and its permissions. Choose a row to see its details.
Replace a key
A key cannot be edited or renewed. To change its permissions, or to replace a key that leaked, create a new one, give it to the tool, check that the tool works and then revoke the old key.
Revoke a key
- Open the «⋯» menu of the key and choose «Revocar». The same button is in the key's details, in the danger zone («Zona de peligro»).
- Confirm. Anything that uses the key stops working immediately, and this cannot be undone. The key stays in the list, marked as revoked.
A key follows the administrator who created it
The key acts with the identity of the administrator who created it, and the changes it makes are saved under that person. The activity history also shows that they came through the API, with the key's name. If that person leaves the account, is deactivated or stops being an administrator, the key stops working and the tool receives a “key owner” error. Create a new key from an account that is still an administrator. See Roles and permissions.
Changes through the API can start your workflows
A change made through the API is handled like one made in the app: it can start the workflows of your account that listen to that event. This cannot be switched off for a single request. Before connecting a tool that writes, check which workflows are active.
If the first call fails
| What the tool reports | What it means | What to do |
|---|---|---|
| Key not valid, revoked or expired | The key was copied incompletely, or it was revoked or has passed its expiry date | Check the key's status in the list; create a new key if needed |
| The user who created the key is no longer active, or is no longer an administrator | The key's owner changed | Create a new key from an administrator |
| The key does not have the required scope | The key lacks a permission the call needs | Create a new key that includes it |
| Your plan does not include the add-on | The call needs a module that your plan does not have | Add the module to your plan |
| Rate limit exceeded | The key made too many requests in a minute | Wait and try again |
- Choose what a key may do: API permissions (scopes).
- How many requests a key can make: Rate limits explained.
- Modules that some calls need: The Subscription & billing page.
- Keep another system up to date: React to changes without webhooks.
Frequently asked questions
No. Filmo keeps only a fingerprint of the key, so it cannot show it again. If you lose it, create a new one and revoke the old one.
Up to 50 that are not revoked, counting expired keys and connected AI assistants.
Every administrator of the account sees all its keys, including those created by others, and can revoke them.
No. Those assistants connect with a link and your approval. See Connect an AI assistant.