Authentication

Every request to the Fuse API is authenticated with an API key. Keys look like this:

af_3de1c09a4b2f48a1b7c2d5e6f7a8b9c0

Create an API key

Open the Fuse app and go to Settings → API Cockpit.
Click Create New Key.
Copy the key immediately — the full value is shown only once, at creation. Afterwards the app displays a masked form (af_3de1c09...b9c0).

Treat API keys like passwords. Never commit them to source control, embed them in client-side code, or share them in tickets. If a key leaks, revoke it in API Cockpit and create a new one — revocation is immediate.

Use the key

The API uses HTTP Basic authentication and accepts two equivalent forms of the Authorization header.

Standard Basic auth (recommended)

Send the key as the Basic-auth username with an empty password. This is standard RFC 7617 behavior, so every HTTP client and every SDK generated from our OpenAPI spec does it for you:

curl https://api.tryfuse.ai/api/v1/business/me \
  -u "af_YOUR_KEY:"

import requests

response = requests.get(
    "https://api.tryfuse.ai/api/v1/business/me",
    auth=("af_YOUR_KEY", ""),
)
print(response.json())

const response = await fetch("https://api.tryfuse.ai/api/v1/business/me", {
  headers: {
    Authorization: `Basic ${Buffer.from("af_YOUR_KEY:").toString("base64")}`,
  },
});
console.log(await response.json());

Raw token form

The header is also accepted with the raw key in place of the encoded credential:

curl https://api.tryfuse.ai/api/v1/business/me \
  -H "Authorization: Basic af_YOUR_KEY"

Both forms resolve to the same key and behave identically. Use whichever your tooling produces; existing integrations using the raw form keep working.

Authentication failures

Status	Code	Meaning
`401`	`UNAUTHORIZED`	The key is missing, malformed, expired, or revoked.
`403`	`INSUFFICIENT_SCOPE`	The key is valid but not scoped for this endpoint — see scopes.

Both come wrapped in the standard error envelope, including a request_id you can quote to support.

Key lifecycle

Keys never expire by default; an optional expiry can be set at creation.
Revoking a key in API Cockpit takes effect immediately.
Keys are scoped at creation. A key with no explicit scopes has access to every endpoint; a scoped key is limited to its scopes (details).

Get started

Concepts

Guides

Create an API key

Use the key

Standard Basic auth (recommended)

Raw token form

Authentication failures

Key lifecycle

​Create an API key

​Use the key

​Standard Basic auth (recommended)

​Raw token form

​Authentication failures

​Key lifecycle

Create an API key

Use the key

Standard Basic auth (recommended)

Raw token form

Authentication failures

Key lifecycle