API Keys for Watch and Automation

API keys let scripts, shortcuts, and watch automations talk to your FuelKit account without your Google sign-in. The classic use: a phone automation that pushes your watch's active calories into FuelKit every evening, so your net balance is right without typing anything.

Create a key

In Profile → API keys, create a key with a name (so you'll recognize it later) and a scope:

• read — can look at your data but never change it.
• readwrite — can also log food, push active calories, and record weigh-ins.

Give each integration the smallest scope it needs.

The key is shown once, at creation — copy it then. FuelKit stores only a fingerprint, so a lost key can't be re-displayed; just revoke it and make a new one.

Use a key

Send it as a bearer token to https://fuelkit.app/api/v1/...:

Authorization: Bearer <your key>

Two examples:

# Read today's log
curl -H "Authorization: Bearer $KEY" https://fuelkit.app/api/v1/log/2026-08-20

# Push the watch's active calories for the day (readwrite scope)
curl -X POST -H "Authorization: Bearer $KEY" -H "Content-Type: application/json" \
  -d '{"measured": 450}' https://fuelkit.app/api/v1/active/2026-08-20

Pushed "measured" calories add to any activities you logged by hand — see Logging Food for how the two layers combine.

Always point automations at fuelkit.app — never at a pages.dev address, which some networks silently block.

Manage and revoke

The API keys list shows each key's scope, creation date, and when it was last used — a key that's never used again is safe to delete. Revoking is immediate: the next request with that key fails. Treat keys like passwords; if one may have leaked, revoke it and issue a fresh one.

Keys are personal — they act as you, and they're deleted with your account.