Skip to main content
Every request to the Fuse API is authenticated with an API key. Keys look like this:

​
Create an API key

  1. Open the Fuse app and go to Settings → API Cockpit.
  2. Click Create New Key.
  3. Copy the key immediately — the full value is shown only once, at creation. Afterwards the app displays a masked form (af_3de1c09...b9c0).
Treat API keys like passwords. Never commit them to source control, embed them in client-side code, or share them in tickets. If a key leaks, revoke it in API Cockpit and create a new one — revocation is immediate.

​
Use the key

The API uses HTTP Basic authentication and accepts two equivalent forms of the Authorization header. Send the key as the Basic-auth username with an empty password. This is standard RFC 7617 behavior, so every HTTP client and every SDK generated from our OpenAPI spec does it for you:

​
Raw token form

The header is also accepted with the raw key in place of the encoded credential:
Both forms resolve to the same key and behave identically. Use whichever your tooling produces; existing integrations using the raw form keep working.

​
Authentication failures

Both come wrapped in the standard error envelope, including a request_id you can quote to support.

​
Key lifecycle

  • Keys created in API Cockpit never expire. Revoke a key when you no longer need it.
  • Revoking a key in API Cockpit takes effect immediately.
  • Keys created in API Cockpit carry every scope, so they can call every endpoint. Choosing scopes or an expiry is not available in the app yet.
  • The scheme must be written Basic, with a capital B.