Skip to main content
If you’ve never called an API, start here. Each term below comes up on almost every page that follows, and each entry says what the term means and what it changes when you build on Fanvue. Once they make sense, Build your first app walks you through a real call.
An API (application programming interface) is a set of URLs a program calls instead of a person clicking through a website. Each call is an HTTP request: a method such as GET or POST, a URL such as https://api.fanvue.com/users/me, headers and sometimes a body. The server answers with a status code (200 for success, 401 or 403 for refused access) and a JSON body.Every Fanvue endpoint is an HTTP request with two required headers, Authorization and X-Fanvue-API-Version.
OAuth 2.0 is the standard way a user lets an app act on their behalf without handing over their password. The user signs in on Fanvue and approves your app, and Fanvue gives the app a token instead of the password.Every Fanvue integration authenticates this way, using the authorization code flow with PKCE; Authentication explains it in full.
A Bearer token is a string your app sends with each request to prove it is allowed in. You add it to the request as a header: Authorization: Bearer <your-token>. Whoever holds the token can use it, so treat it like a password.Every call to https://api.fanvue.com needs a valid Bearer token, or the request is rejected with 401 Unauthorized.
Scopes are the specific permissions a token carries. Each scope grants access to one kind of data or action, for example read:chat to read messages or write:post to publish posts. A request that needs a scope the token lacks returns 403 Forbidden.You request only the scopes your app needs, such as read:self, read:insights or write:media, and users see exactly what they are approving.
A redirect URI is the address on your app where Fanvue sends the user back after they sign in and approve access. It must exactly match a redirect URI set on your app’s Authentication tab or in its App Manifest, otherwise the sign-in is refused.Registering the right redirect URI is what lets the authorisation step hand control, and the login result, back to your app.
An access token is the short-lived Bearer token you send on each API call. A refresh token is longer-lived, and your app uses it to get a fresh access token without making the user sign in again.Request the offline_access scope to receive a refresh token, so your app keeps working after the access token expires.
The Developer Area is where you create apps, read your Client ID, reset your Client Secret and set redirect URIs and scopes. A creator account or an agency admin account with a verified email can use it; fan accounts cannot.Your first call starts there, and so does every app you later list on the App Store.