Using the Fiscal Flowcast API (Premium+)

Premium and Enterprise users can access Fiscal Flowcast data programmatically using our GraphQL API and a personal API key. Use it for custom integrations, automation, or pulling your data into external dashboards.

Who Can Use the API?

API access is available on PREMIUM and ENTERPRISE plans only. FREE and BASIC users can use the website but cannot authenticate programmatic API access. Upgrade to Premium to unlock API keys.

Getting an API Key

Sign in and open the Account menu in the sidebar (bottom-left).
Click Developer — this opens Developer Settings.
Click New key, give it a name (e.g. "My dashboard script"), and select the scopes you need.
Click Create key. Copy the secret immediately — it will not be shown again. Store it in a password manager or secrets manager.

How Your Key Is Stored

The full secret is shown to you only once, at creation. We do not keep a copy you can retrieve later. On our servers we store only a one-way SHA-256 hash of the key plus a short non-sensitive prefix (used to identify the key in the list). Because a SHA-256 hash cannot be reversed back into the original secret, we cannot recover or re-display your key — if you lose it, rotate the key to get a new one. This is hashing, not reversible encryption: there is no key material on our side that could decrypt your secret.

Available Scopes

Select the minimum scopes your integration requires:

read — Read financial data (accounts, transactions, forecasts, net worth, cash flow, budgets, goals, reports — full server read allowlist)
write — Create and update transactions via GraphQL mutations
mcp — Hosted MCP connector keys (separate from GraphQL; see Developer Settings)

Older keys may still list legacy read:* labels. They continue to work; rotate the key in Developer Settings to refresh to read / write.

Authenticating Requests

Pass your API key in the X-API-Key header on every request.

GraphQL Endpoint

The API uses GraphQL. Send all queries and mutations as POST requests to:

Code Samples

List your accounts (curl):

Fetch recent transactions (curl):

Revoking a Key

To revoke a key that is no longer needed or may be compromised, go to Developer Settings, find the key in the list, and click Revoke. Revocation is immediate — any request using that key will fail with 401 Unauthorized.

Rotating a Key

Key rotation replaces an existing key with a new one without losing its name or scopes. Go to Developer Settings, find the key, and click Rotate. Confirm the action, then copy the new secret immediately — it is shown only once. The old key is revoked the moment you confirm; update all integrations before dismissing the new-secret dialog.

Monitoring Usage

The Developer Settings table shows Today and Last 30 days request counts for each key, so you can see which keys are active and spot unexpected spikes. Counts reset at midnight UTC.

Security Best Practices

Never commit API keys to source control or paste them in chat/logs
Store keys in environment variables or a dedicated secrets manager (e.g. AWS Secrets Manager, HashiCorp Vault, 1Password Secrets Automation)
Create separate keys for separate integrations so you can revoke one without affecting others
Request only the scopes your integration actually needs
Rotate keys periodically or immediately after any suspected exposure — use the Rotate button in Developer Settings for a zero-downtime replacement

Rate Limiting

The API applies a per-minute rate limit to protect stability. Premium keys allow up to 100 requests per minute; Enterprise keys allow more. Each key in Developer Settings shows its per-minute ceiling and the approximate remaining budget in the current window (for example, 87 / 100 req/min). The remaining count is approximate — it reflects a single server's recent view of the current minute and may differ slightly across requests. If you receive a 429 Too Many Requests response, pause and retry after the duration indicated in the Retry-After response header.

For plan details see Plans and Feature Limits and Feature Availability by Tier. To manage your keys visit Developer Settings.

Plans and Feature LimitsUnderstand what each plan includes, why a feature might be locked, and how to upgrade.
Feature Availability by TierSee which features and limits apply to FREE, BASIC, PREMIUM, and ENTERPRISE plans.
How to Upgrade Your PlanStep-by-step instructions for upgrading from FREE to BASIC, PREMIUM, or ENTERPRISE.

Using the Fiscal Flowcast API (Premium+)