Keys and access
The agent enters Felku with a key, sent in the header Authorization: Bearer <key>. Your dashboard session (your login) does not work on MCP, and the key doesn't work in the dashboard.
Create a key
In the dashboard, under Agents and keys, create the key with:
Name, so you know which agent uses it.
Connection (optional): the key is tied to that connection's channel (WhatsApp or Telegram): the agent only sees and only uses that channel's tools. If the connection is deleted (when downgrading, or when a paused connection runs out of time), the keys tied to it are revoked and never become free keys. Disconnecting the number doesn't delete the connection: the keys stay tied to it.
Permissions (scopes): what the agent can do, see below. In the dashboard, the key starts with only the read permissions checked; check the sending ones only if the agent needs them. You can't change a key's permissions later: to do that, revoke it and create another.
Expiry (optional): the key stops working on its own on the chosen date.
The key starts with fkc_ and is shown in full only once. We keep only a fingerprint of it (hash) and the first 8 characters, so you can recognize it in the list, along with the last-used date. If you lose it, revoke it and create another.
To create a key, the account needs an active or trialing plan and a confirmed email.
Permissions (scopes)
| Scope | Unlocks |
|---|---|
whatsapp:read | read new WhatsApp messages (felku_read_new_messages) and, for groups, communities and channels: felku_list_groups, felku_read_group_messages, felku_list_available_groups, felku_list_communities, felku_get_community, felku_get_group_info, felku_list_labels, felku_newsletter_info, felku_newsletter_read_messages |
whatsapp:write | send and act on WhatsApp: text, mark as read, react, typing, check number, edit and delete its own message (felku_send_text, felku_mark_read, felku_react, felku_set_typing, felku_check_number, felku_edit_message, felku_delete_message) Also: felku_star_message, felku_create_label, felku_label_chat, felku_label_message, felku_newsletter_follow and the ones that write to or administer groups, communities and channels |
telegram:read | read the Telegram bot's messages (felku_telegram_read_updates) |
telegram:write | send through the bot (felku_telegram_send_message) |
connections:read | see the connection status and limit usage (felku_get_connection_status, felku_get_policy_status) |
connections:write | get the pairing link and pause a connection (felku_start_pairing, felku_pause_connection) |
A key created without choosing scopes (through the API) gets read only: connections:read, whatsapp:read and telegram:read (when the plan has Telegram). To send, ask for the sending ones. The agent only sees the tools the key allows: tools/list comes filtered. If it can't find a tool (Unknown tool), the key doesn't have that permission.
There are also elevated permissions, which are never added on their own: only if you ask for them on purpose.
| Elevated scope | Unlocks |
|---|---|
risk:high | the high-risk actions, which come switched off. On its own it does not unlock the group, community and channel tools: they ask for the specific action: scope. |
action:<type> | unlocks a single specific high-risk action. On WhatsApp, for groups, communities and channels: action:group_read_enable (ask to enable reading), action:group_send_enable and action:group_send (enable and send to a group, community announcements), action:channel_react, action:group_create, action:group_add, action:group_manage, action:community_manage, action:channel_admin. |
The group, community and channel tools are in Tools. The key-creation screen in the panel does not offer the action:... permissions today: they can only be put on a key created through the API.
Good practices:
One key per agent. That way you revoke one without taking down the others.
Only what's needed. An agent that only summarizes chats needs just
whatsapp:read(andconnections:readto see the status). Note: even mark as read and react needwhatsapp:write, because the other person sees them.Only one agent with send permission per connection, to avoid double replies (each key reads with its own cursor).
How many keys each plan has
| Plan | Connections | Keys |
|---|---|---|
| 7-day trial | 1 | 2 |
| Personal | 1 | 2 |
| Pro | 5 | 10 |
| Business | 15 | 50 |
A bigger plan does not raise the sending limits: the guards are the same for everyone (why).
Before you connect a channel
The key only works after the account has connected WhatsApp or Telegram. Until then, every MCP request (including initialize and tools/list) comes back with HTTP 403 and the code connection_required, with the message "Your key is valid, but no channel is connected yet...". The key is fine: connect a channel in the dashboard, under Connections › New connection, and try again.
Revoke
In the dashboard, under Agents and keys, revoke the key. It stops working immediately (the next request returns unauthorized). If you suspect a leak: revoke the key, pause or disconnect the number and change your account password.
When the subscription doesn't allow sending
If the payment was declined and the 7-day grace period is over, or if the subscription was canceled, keys lose their send permissions (all :write). Reading keeps working, so you can look up and delete your data.
Access responses
| HTTP | Code | What it means |
|---|---|---|
| 401 | unauthorized | key missing, wrong, expired or revoked |
| 403 | connection_required | the key is valid, but the account hasn't connected any channel yet. Connect WhatsApp or Telegram in the dashboard |
| 403 | not_your_connection | the key is valid, but can't use this connection (it belongs to another account) |
| 405 | method_not_allowed | the MCP server only accepts POST |
A key tied to one connection that tries a tool from the other channel is not refused at the HTTP level: the call returns normally, with the error key_bound_to_other_channel in the tool result. Use a key for the right connection (or a key not tied to any connection).