FDA Intel

Getting started

Authentication

Every request carries a Bearer credential. AI apps get one through OAuth; your code uses an API key. Both work on the MCP server and the REST API.
OAuth access token fdi_at_…
Claude, ChatGPT and other MCP clients. Issued after you sign in and approve read-only access. Valid 1 hour; the app refreshes it on its own (refresh tokens rotate and last 90 days).
API key fdi_ak_…
Your own code, and MCP clients that can't do OAuth. Created on your account page. No expiry; revoke it there at any time.

API keys#

  • Create keys on Account → AI & API. The full key is shown once; we store only a hash.
  • Send it as Authorization: Bearer fdi_ak_…. Never in a URL, a query string or a chat.
  • Each key belongs to one person and counts against that person's plan. On Premium, each team member creates their own keys.
  • Revoke a key the moment you think it leaked; requests with it fail within a minute.
Header
GET /api/intel/v1/stats HTTP/1.1
Host: fdaintel.ai
Authorization: Bearer fdi_ak_…

OAuth 2.1 for MCP clients#

The MCP server follows the MCP authorization specification, so clients need only the server address. The flow:

  1. The client calls https://fdaintel.ai/mcp without a token and gets 401 with a WWW-Authenticate header pointing to the protected resource metadata.
  2. It reads the metadata, then the authorization server metadata, and registers itself (dynamic client registration).
  3. It opens the FDA Intel sign-in in a browser with PKCE (S256). You sign in and click Allow.
  4. It exchanges the code for an access token and a refresh token, and calls the tools.
401 without a credential
HTTP/1.1 401 Unauthorized
WWW-Authenticate: Bearer realm="FDA Intel", resource_metadata="https://fdaintel.ai/.well-known/oauth-protected-resource/mcp", scope="intel:read"
Content-Type: application/json

{"error":"unauthorized","error_description":"Sign in to FDA Intel to use this API."}

Endpoints and metadata#

Protected resource metadata (RFC 9728)
https://fdaintel.ai/.well-known/oauth-protected-resource/mcp
Authorization server metadata (RFC 8414)
https://fdaintel.ai/.well-known/oauth-authorization-server
Dynamic client registration (RFC 7591)
POST https://fdaintel.ai/oauth/register
Authorization
https://fdaintel.ai/oauth/authorize
Token (form-encoded)
POST https://fdaintel.ai/oauth/token
Revocation (RFC 7009)
POST https://fdaintel.ai/oauth/revoke
Grant types
authorization_code (PKCE S256 required), refresh_token
Client authentication
none (public clients), client_secret_post, client_secret_basic
Scope
intel:read
Redirect URIs
https, or http on localhost / 127.0.0.1 for desktop and CLI tools

Permissions

Every tool is read-only. An app you connect can search and read; it can never change, buy or delete anything. Disconnect apps on your account page.

Who can use the API#

Accounts with an active Standard or Premium plan, and the people added to a Premium plan. Without a plan, requests return 403 subscription_required and MCP tool calls explain how to start one.