Developer Apps & the Fytkit SDK

Overview

If you want to build your own client experience rather than use the standard portal, the Fytkit SDK lets you talk to your Fytkit data from your own web or mobile app. To do that you need a developer app, which gives you a publishable clientId. Manage these under Configuration → Developer.

This is an optional, technical feature — you don’t need it to run your coaching business on Fytkit.

1. View Your Apps

Go to Configuration → Developer. The table lists each app with its Name, Client ID, Status, and Last used date. Each Client ID has a copy button beside it.

2. Create an App

1. Click Create app. A drawer opens with the app’s settings.
2. Enter a Name — e.g. “My Coaching App”. This is just for your own reference.
3. Add your Allowed origins (see below), then save. Your clientId is shown as soon as the app is created.

3. Configure Allowed Origins

Requests are accepted only from the origins you list here — this is what stops someone else’s site using your Client ID. Type an origin and press Enter to add it.

• Use a bare origin with no path, query, or trailing slash — e.g. https://app.example.com.
• Origins must use https, with one exception: http://localhost and http://127.0.0.1 are allowed so you can test locally before publishing.

4. Native App Support

Turn on Allow native apps if you’re building an iOS or Android app (for example with React Native). Native apps send no Origin header, so they can’t be matched against your allowed-origins list — this toggle is what lets those requests through. Leave it off if you’re only building for the web.

5. Password Reset URL

Optionally set a Password reset URL — the deep link your clients land on when they reset their password from your app, e.g. https://app.example.com/reset. This URL is embedded in an email and clicked from arbitrary mail clients, so it must use https — localhost isn’t accepted here. Leave it blank while you’re still developing.

6. Revoke an App

Each app has a Status toggle: active or revoked. Revoking is the right move if a Client ID has been misused or an integration is retired.

Revoking is an instant cut-off: a revoked app rejects every request, including those from clients who are already signed in. Deleting an app has the same immediate effect. To rotate a Client ID without an outage, create a new app, move your clients over to it, then revoke or delete the old one.

Tips

• The clientId is publishable — it’s designed to ship in browser code. Your allowed-origins list, not secrecy, is what protects it.
• Create separate apps for development and production. That way you can add localhost to the dev app without loosening your live one.
• Check the Last used column before deleting an app — it’s the quickest way to tell whether an integration is still live.