Fact It
Developers

Authentication

Every call to /api/check and /api/check/stream must be authenticated. Programmatic callers send an API token as a Bearer credential; the signed-in dashboard and extension authenticate with a session cookie instead.

Authentication is required

/api/check and /api/check/stream reject unauthenticated requests with a 401 ({ "error": "sign in to run fact checks", "code": "unauthenticated" }) — every check is metered against an account, so there is no anonymous tier. There are two ways to authenticate:

  • API token — for programmatic callers (scripts, servers, the browser extension). Send it as Authorization: Bearer fk_…; mint one below.
  • Session cookie — the signed-in dashboard calls the same endpoints with your better-auth session, so first-party browser requests need no token.

Mint an API token

  1. Sign in and open your account page.
  2. In the API tokens section, create a token.
  3. The raw token (it looks like fk_…) is shown exactly once — copy it immediately and store it somewhere safe. We keep only a SHA-256 hash server-side, so we cannot show it to you again.

Send the token

Pass the token in the Authorization header as a Bearer credential:

curl https://fact-it-web-412159981305.us-central1.run.app/api/check \
  -H 'Authorization: Bearer fk_your_token' \
  -H 'Content-Type: application/json' \
  -d '{ "response": "The Eiffel Tower is 984 feet tall." }'

What a token can do

A token is deliberately low-privilege. If leaked, it can only:

  • call /api/check and /api/check/stream, and
  • read your balance at /api/account/usage.

It cannot mint or revoke tokens, read or change your account settings, or touch your bring-your-own-key (BYOK) provider keys. Those actions require a logged-in session cookie, not a token. Tokens are stored only as a SHA-256 hash, so a database leak never exposes usable credentials. Revoke a token any time from the account page.

Bring your own verifier (BYOK)

You can optionally override the verifier model with your own provider key (ADR-0005). This is configured per-account from your session (not via an API token) and is out of scope for the token flow above — the default fixed stack is used unless you both select a model and supply the matching key.

Next

Ready to make a call? Head to the Quickstart.