Fluos API authentication
Browser sessions for the dashboard and OAuth for the paid video API, CLI, and MCP.
Fluos has two auth stories: browser sessions for the product, and OAuth for the paid video API, CLI, and MCP.
Product sessions
Fluos never stores a password. Users sign in with Google, Apple, or a one-time email code. See Getting Started.
Authenticated product routes (/dashboard and most /api/* handlers) expect a session cookie from the signed-in browser. Unauthenticated calls receive:
{ "error": "Unauthorized", "code": "unauthorized" }Paid video API and MCP (OAuth)
Coding agents connect to /api/v1/mcp/app and the /api/v1/videos family with a Bearer OAuth access token. Discovery:
/.well-known/oauth-protected-resource/mcp/.well-known/oauth-authorization-server
Scopes: profile, email. MCP hosts should use Fluos's public OAuth client ID vZg47Po1X1v3rHtU (no secret). Unauthenticated calls return 401 plus WWW-Authenticate. Free plans receive 402 / PLAN_REQUIRED.
The CLI reads the same token from FLUOS_API_TOKEN after npx fluos login.
Video routes authenticate inside the handler, so OAuth clients can complete discovery without a browser session.
Public endpoints
These do not require a session:
/openapi.json,/api/v1/openapi.json,/llms.txt,/llms-full.txt,/ai.txt/sitemap.xml,/robots.txt,/feed.xml/docs,/docs/developers,/cli,/mcp, marketing pagesGET /api/v1/searchandGET /api/searchGET/POST /api/v1/mcp(docs MCP only)- Content negotiation on public pages (
Accept: text/markdownorapplication/json)
Workspace connectors
Figma, Notion, Google Drive, Slack, and Linear connections are authorized from Skills and Connectors inside a Fluos workspace, through each provider's own OAuth screen. That flow is user-initiated in the product. See Connectors.
The public docs MCP at /api/v1/mcp is a separate, unauthenticated discovery surface. Video creation uses the paid Video MCP at /api/v1/mcp/app. See OAuth and access.