Sessions

Unlike Importer, Feedback does not expose a public widget session API. There is no POST /api/v1/sessions for the embed to start or complete. Operational counts for the workspace are available to secret keys only.

GET /api/v1/usage

Authenticate with Authorization: Bearer and a secret key (bsw_test_sec_ / bsw_live_sec_). Response is wrapped as { "data": ... }:

{
  "data": {
    "boards": 2,
    "posts": 41,
    "sessions": 0,
    "environment": "live"
  }
}

• Counts are scoped to the key's workspace and environment (test vs live).
• They are operational information, not a metered invoice line.
• They never include post title or body. Do not treat usage as a content export.

curl -s https://feedback.bootstrapware.co/api/v1/usage \
  -H "Authorization: Bearer $BSW_SECRET"

Hosted content is separate

On Hosted ($19.99), Bootstrapware stores posts and votes (plain text). That content path uses the publishable Hosted post routes and the dashboard inbox, not usage counts and not MCP. BYO adapters keep posts on your backend entirely; usage may still report board/config-side aggregates for the workspace.

MCP configures boards only. Never send post title or body through MCP tools.

Why there is no public session start

Feedback's security model is host-asserted author.id plus publishable config / Hosted store calls. A separate browser "session" object would not add a trust boundary and is not part of the public API surface. Prefer API overview for the real publishable and secret routes.

Related: API overview · Webhooks · Modes · API keys