Fiko Developers

Introduction

Build on Fiko: connect AI agents through MCP, take bookings on your own website, react to booking events with signed webhooks and control the website chat from JavaScript.

Fiko is an AI customer-messaging platform for businesses: one inbox for Instagram, WhatsApp, Telegram and website chat, an AI agent that answers customers, workflows, a CRM, appointment booking, a link-in-bio page and social publishing. Everything a business owner does in the dashboard can also be reached from code.

MCP server

Let Claude, ChatGPT, Grok or your own agent run a Fiko account.

Booking widget

One script tag: inline form, popup, floating button or a link.

Booking API

Build your own booking UI or sync bookings with your system.

Booking webhooks

Signed events for every booking change, with retries.

Website chat widget

Open, identify, send messages and listen to chat events.

Which one do I need?

You want to…	Use	Where it runs
Let Claude, ChatGPT, Grok, Cursor or your own agent read and run a Fiko account	MCP server	Your AI client
Take bookings on your own website without writing a booking UI	Booking widget	Your website, one `<script>` tag
Build your own booking screens, or create bookings from your app or backend	Booking API	Browser or server
Update your CRM, send an SMS or start a job when a booking changes	Booking webhooks	Your server
Open the website chat from your own buttons, pass in signed-in customers	Website chat widget	Your website

Hosts

Host	What it serves
`https://api.fiko.net`	REST APIs, the MCP server (`/mcp`), OAuth, webhooks are sent from here
`https://app.fiko.net`	The dashboard, the booking widget script and the hosted booking pages
`https://fiko.io`	This site and businesses' public Fiko Pages (`fiko.io/<page>`)

All traffic is HTTPS. Request and response bodies are JSON (UTF-8), times are ISO 8601.

Authentication

Every credential is created by the business owner in the Fiko dashboard and can be revoked there at any time.

Credential	Looks like	Use it for	Created in
Publishable booking key	`pk_live_...`	Browser code: the booking widget, your own booking form. Only works on the websites you allow.	Settings → API & Developers
Secret booking key	`sk_live_...`	Your server: list bookings, read any booking, cancel as the business. Never put it in a web page or app.	Settings → API & Developers
MCP OAuth	—	AI clients that support OAuth sign the owner in and ask for permissions. No key to copy.	The client's connector settings
Personal access token	`fiko_pat_...`	Scripts and agents that send a header instead of OAuth.	Settings → API & Developers
Webhook signing secret	`whsec_...`	Checking that a webhook really came from Fiko.	Settings → API & Developers

Secrets are shown once, when they are created or rolled. Fiko stores only a hash, so a lost secret cannot be recovered; roll a new one instead.

Errors

REST endpoints answer with a regular HTTP status and a JSON body you can show or log:

JSON

{
  "error": {
    "code": "slot_unavailable",
    "message": "This time is not available. Please choose another time."
  }
}

code is stable and meant for your code; message is written for people. The codes for each API are listed on its page. MCP tools report problems as tool results with isError: true and a plain explanation of what to fix.

Status	Meaning
`400`	The request is missing something or a value is not valid.
`401`	The key or token is missing, wrong or revoked.
`403`	The key is valid but not allowed here (for example a publishable key on a website that is not on its list).
`404`	Not found, or it belongs to another business.
`409`	Conflict, such as a time that was just taken.
`429`	Too many requests. Wait for the number of seconds in the `Retry-After` header.
`5xx`	Something failed on Fiko's side. Retry with backoff; booking requests with an `Idempotency-Key` are safe to retry.

Limits

API	Limit
Booking API, publishable key	240 reads per minute and 20 bookings per hour, per website visitor
Booking API, secret key	600 reads per minute and 1,000 bookings or cancellations per hour, per key
MCP server	120 tool calls per minute per connection

If you need more, write to support@fiko.net.

Versioning

The REST paths carry a major version (/api/v1/...). Within a version we only add things: new endpoints, new optional fields, new event types and new error codes. Write your code so that unknown fields and event types are ignored. Webhook payloads also carry an api_version date. Anything that breaks existing code ships as a new version, announced in advance.

Testing

There is no separate sandbox account. Use your own Fiko account with a test service, or set a key to Request mode so nothing is confirmed until you approve it. Booking webhooks have a Send test button that delivers a signed ping event, and the delivery log shows what your server answered.

Machine-readable docs

MCP guide in Markdown, always current: api.fiko.net/mcp/docs
api.fiko.net/llms.txt for AI crawlers and agents
OAuth metadata: api.fiko.net/.well-known/oauth-authorization-server

Questions or something missing? Write to support@fiko.net.