Create an MCP key
Create a Flyga key for a script, a cron job, or another program that calls Flyga on its own.
This page is for a script, a cron job, or another program that calls Flyga on its own. To use Flyga inside Cursor, Claude, or Grok in Cursor, follow Connect your assistant.
The key is a long secret that starts with flyga_mcp_. Treat it like a password. It can read and update your Plan account. The program sends it as Authorization: Bearer, along with Accept: application/json, text/event-stream and a Chrome User-Agent.
If you do not see API keys under Account, this is not available on your account yet.
Open API keys
Section titled “Open API keys”On go.flyga.app, open Account → API keys.
Create a key
Section titled “Create a key”Click New key. Name it after the machine that will send it — “Grok Bot weekly optimizer”, “curl on the NAS”.
Leave the switches on Always allow for anything you want that agent to do. Turn a group to Don’t allow if this key should not see that part of your account (for example, a read-only catalog key with Wallet and Transfers off).
| Group | What the agent can do |
|---|---|
| Catalog | Programs, valuations, live bonuses, transfer options, Transfer Optimizer, airports, airlines, lounges / private terminals, and reporting catalog data issues |
| Redemptions | List your award bookings; Write logs or edits them |
| Transfers | List recorded transfers; Write logs or edits them |
| Wallet | See tracked balances and the cards already in your wallet; Write updates a balance, or starts or stops tracking a program |
| Benefits | List card benefit claims; Write marks them used, hidden, or written off |
Click Create.
Copy the secret once
Section titled “Copy the secret once”The full key is shown once. Copy it into the program’s secret store or config. If you close the dialog without copying, create another key.
Always allow vs Don’t allow
Section titled “Always allow vs Don’t allow”Always allow means Flyga will run that kind of call. Don’t allow hides it so the program cannot call it.
You can change a key’s permissions later from the same page. Revoke it if it leaks — it stops working on the next request.
Send the key
Section titled “Send the key”Point the program at https://api.flyga.app/mcp. Send all three:
Authorization: Bearerplus theflyga_mcp_secretAccept: application/json, text/event-stream- a Chrome
User-Agent
Put the secret in the job’s environment or the client’s private config.