Developers
Authentication
Chat apps sign in with OAuth on feedlio.io; code and scripts use a personal access token. Both are limited to the scopes you allow.
Two ways to sign in
| OAuth | Personal access token | |
|---|---|---|
| For | Claude, ChatGPT and other chat apps | Claude Code, Cursor, scripts |
| How | The client opens Feedlio's sign-in page; you click Allow | Create a token in Settings → MCP, send it as Authorization: Bearer fdl_… |
| Lifetime | 1-hour access token, 30-day refresh token that rotates on each use | Until you revoke it |
| Revoke | Settings → MCP → Connected apps | Settings → MCP → Personal Access Tokens |
Your Feedlio password never reaches the AI client. Tokens act as you, inside your plan and workspaces.
Scopes
| Scope | Allows |
|---|---|
workspaces:read | List workspaces |
workspaces:write | Create workspaces, set the default, delete workspaces |
accounts:read | List connected social accounts |
posts:read | List posts and media, TikTok creator info, Pinterest boards, upload status |
posts:write | Create, edit, reschedule, cancel and delete posts; add, upload and delete media |
The sign-in page shows the scopes a client asks for before you allow it. Give personal access tokens only the scopes a script needs.
How clients find the sign-in
A request to /mcp without a token gets 401 with a WWW-Authenticate header pointing to the protected-resource metadata. From there, clients discover the authorization server (/.well-known/oauth-authorization-server), register (dynamic client registration or a Client ID Metadata Document) and use PKCE (S256).
Keep tokens safe
- Never commit a token to a repository or paste it into a shared chat.
- Use one token per script or machine, so you can revoke one without breaking the others.
- Revoke tokens you no longer use.