Authentication

Every request must carry an API key as a bearer token:

Authorization: Bearer sf_live_xxxxxxxxxxxxxxxxxxxxxxxx

curl https://app.shortfast.com/api/v1/videos \
  -H "Authorization: Bearer sf_live_xxxxxxxxxxxxxxxxxxxxxxxx"

Create and revoke keys

Create and revoke keys under Settings > API & Webhooks in the ShortFast app. A REST key starts with sf_live_. A workspace can hold at most 25 keys.

Each key is scoped to the workspace it was created in, and every query the API runs is scoped to that workspace. A video, automation, profile or webhook that belongs to another workspace answers 404, never someone else's data.

What a bad key looks like

A missing, malformed, revoked or unknown key is a 401 on every path, including the ones that take no parameters:

{
  "error": {
    "status": 401,
    "code": "unauthorized",
    "message": "The API key is missing or invalid. Pass it as a Bearer token in the Authorization header."
  }
}

There is no unauthenticated endpoint, so a 401 always means the credential and never the request body. GET / is the cheapest call to verify a key with: it reads nothing beyond the workspace the transport already loaded, and returns that workspace's plan, credits and limits.

Acting as a workspace in your organization

An organization key can operate on any workspace inside it without a separate key, by naming the target in a request header:

X-ShortFast-Workspace: <workspaceId>

curl https://app.shortfast.com/api/v1/videos \
  -H "Authorization: Bearer sf_live_xxxxxxxxxxxxxxxxxxxxxxxx" \
  -H "X-ShortFast-Workspace: k9WmT3xR2pQ7nV4bd"

With the header set, every endpoint acts on that workspace: its videos, its automations, its profiles, its webhooks. Omit it to act on the organization itself.

The header is only honored for an organization key targeting one of its own workspaces. Any other value is rejected with 401, so a leaked workspace id buys nothing.

For the MCP server, append &workspaceId=<workspaceId> to the connection URL instead: an MCP connection is long-lived and carries no per-request headers.

Reference