> This page is for Developer.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.feedonomics.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.feedonomics.com/_mcp/server.

# Authentication API

> Generate an API token and send it in the x-api-key header on every request

Before calling the Feedonomics REST APIs, your application must generate an API token. You generate the token by calling `POST /login` twice against `https://meta.feedonomics.com/api.php`: once to receive a two-factor authentication (2FA) token by email, and once to exchange that 2FA token for an API token. You then send the API token in the `x-api-key` header on every authenticated request.

**Use this API to:**

* Request a 2FA token for your account
* Exchange the 2FA token for an API token
* Label tokens so you can tell them apart when one user creates several

## Which APIs use this token

Send the API token in the `x-api-key` header when calling:

* [Platform API](/developer/api-reference/rest/platform-api)
* [Content API](/developer/api-reference/rest/content-api)
* [Event-Driven Sync API (EDRTS)](/developer/api-reference/rest/event-driven-sync-api-edrts)

> **Note**
>
> The FeedAMP Order APIs use a separate token. For those, call [GET /get_token](/developer/api-reference/rest/feed-amp-order-api-v2/authentication/get-token) with Basic authentication instead of the steps on this page.

## Before you begin

You need a Feedonomics username and password with API access. To request access, submit a **Request Feedonomics API Access** support ticket through the [FeedSupport Portal](https://meta.feedonomics.com/app/#/feedsupport).

## Generate an API token

#### Request a 2FA token

Call `POST /login` with your username, password, and `"method": "token"`. Leave out `twofa_token` on this first call.

**`Step 1 request`**

```bash title="Step 1 request" showLineNumbers={false}
curl -X POST https://meta.feedonomics.com/api.php/login \
  -H "Content-Type: application/json" \
  -d '{
    "username": "<your-username>",
    "password": "<your-password>",
    "method": "token"
  }'
```

The response confirms that a 2FA token was sent to the email address on your account.

**`Step 1 response`**

```json title="Step 1 response" showLineNumbers={false}
{
  "message": "Check your email for a 2FA token, login again with twofa_token param"
}
```

#### Exchange the 2FA token for an API token

Call `POST /login` again with the same credentials, and add the `twofa_token` from the email. Optionally include `name` to label the token, which helps you tell tokens apart when one user creates several.

**`Step 2 request`**

```bash title="Step 2 request" showLineNumbers={false}
curl -X POST https://meta.feedonomics.com/api.php/login \
  -H "Content-Type: application/json" \
  -d '{
    "username": "<your-username>",
    "password": "<your-password>",
    "method": "token",
    "twofa_token": "<2fa-token-from-email>",
    "name": "inventory-sync"
  }'
```

The response contains your API token. Store it securely. You don't need to repeat these steps until the token stops working.

**`Step 2 response`**

```json title="Step 2 response" showLineNumbers={false}
{
  "status": "success",
  "token": "abc123321cba"
}
```

If the credentials or 2FA token are wrong, the endpoint returns `400` with the message `Invalid Authentication`.

#### Send the token in the x-api-key header

Include the API token in the `x-api-key` header on every request to the APIs listed above. For example, to list the accounts your user can access:

**`Authenticated request`**

```bash title="Authenticated request" showLineNumbers={false}
curl https://meta.feedonomics.com/api.php/user/accounts \
  -H "x-api-key: <YOUR_API_TOKEN>"
```

For the full request and response schemas, see the [POST /login endpoint reference](/developer/api-reference/rest/authentication-api/login).