Fireflies API Identity and Access Setup

Overview

Create an auditable identity boundary before any transcript query or mutation. A successful request proves only that the key is accepted; it does not grant permission to enumerate or export meeting content.

Prerequisites

• The target repository or integration path and the requested operator outcome.
• The Fireflies principal, team, environment, and data classification for the work.
• Current Fireflies documentation, credentials only when needed, and an accountable approver.

Current Contract

Fireflies uses POST requests to https://api.fireflies.ai/graphql with Content-Type application/json and Authorization: Bearer . Obtain the key from the Fireflies Integrations page, keep it server-side, and use the smallest identity query needed to confirm the principal and team context.

Authentication

For authenticated operations, inject FIREFLIES_API_KEY from an approved secret manager and send it only as Authorization: Bearer REDACTED_KEY to https://api.fireflies.ai/graphql. Never print, commit, place in a URL, forward to a browser, or include the key in evidence. Webhook signing secrets are separate credentials and must not be reused as API keys.