Developer Authentication

This page describes how authentication works today for the two programmatic surfaces in the MentionFox world: the MentionFox browser extension, and the separate FoxAPIs developer API at foxapis.com. Both use a simple, long-lived API key model. There is no OAuth flow today — you generate a key, you send it with each request, and you keep it secret.

The MentionFox browser extension

The extension talks to MentionFox using a personal extension key tied to your account. You generate the key once and paste it into the extension's options; from then on the extension sends it on every call so MentionFox knows the request is yours.

• Where to get it: in your MentionFox account, open the extension settings page (Settings → Extension), generate a key, and copy it into the extension's options screen.
• How it's sent: the extension attaches your key on each request in an X-Extension-Key header. Keys are prefixed (for example mfx_…) so they're easy to recognize.
• What it authorizes: the key acts on your behalf for the extension's actions — capturing people from a page, enriching a contact, drafting outreach, and saving to your pipeline. It is scoped to your account.

If you ever reload the extension and calls start failing, re-paste your key in the options screen — that field is the live credential the extension uses to authenticate.

The FoxAPIs developer API

FoxAPIs (at foxapis.com) is the standalone developer API product. It is a separate service with its own account, its own keys, and its own credits — a FoxAPIs key is not the same as your MentionFox extension key, and the two balances are independent.

• Where to get it: sign up at foxapis.com and generate an API key from your FoxAPIs dashboard.
• How it's sent: FoxAPIs uses standard bearer-token authentication. Send your key in the Authorization header:

curl -X POST https://api.foxapis.com/v1/<endpoint> \
  -H "Authorization: Bearer YOUR_FOXAPIS_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "query": "example" }'

Every authenticated FoxAPIs request validates the bearer token and is metered against your FoxAPIs credit balance. The live API explorer at foxapis.com/demo lets you try endpoints without a key first; once you have a key, paste it in to run against your own account.

Keeping keys safe

• Treat keys like passwords. Anyone with the key can act as you and spend your credits. Never commit a key to a public repository or paste it into client-side code that ships to browsers.
• Server-side only. Make authenticated API calls from your backend, not from a web page where the key would be visible to visitors.
• Rotate and revoke. If a key is exposed, revoke it from the dashboard that issued it and generate a new one. Revoking takes effect immediately and any integration using the old key stops working.
• Name your keys (where supported) so you know which integration each one belongs to.