> ## Documentation Index
> Fetch the complete documentation index at: https://docs.fuseai.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Create an API key and authenticate every request with HTTP Basic auth.

Every request to the Fuse API is authenticated with an API key. Keys look like this:

```text theme={null}
af_3de1c09a4b2f48a1b7c2d5e6f7a8b9c0
```

## Create an API key

1. Open the Fuse app and go to **Settings → API Cockpit**.
2. Click **Create New Key**.
3. Copy the key immediately — the full value is shown **only once**, at creation. Afterwards the app displays a masked form (`af_3de1c09...b9c0`).

<Warning>
  Treat API keys like passwords. Never commit them to source control, embed them in client-side code, or share them in tickets. If a key leaks, revoke it in API Cockpit and create a new one — revocation is immediate.
</Warning>

## Use the key

The API uses HTTP Basic authentication and accepts **two equivalent forms** of the `Authorization` header.

### Standard Basic auth (recommended)

Send the key as the Basic-auth **username with an empty password**. This is standard [RFC 7617](https://www.rfc-editor.org/rfc/rfc7617) behavior, so every HTTP client and every SDK generated from our OpenAPI spec does it for you:

<CodeGroup>
  ```bash curl theme={null}
  curl https://api.tryfuse.ai/api/v1/business/me \
    -u "af_YOUR_KEY:"
  ```

  ```python Python theme={null}
  import requests

  response = requests.get(
      "https://api.tryfuse.ai/api/v1/business/me",
      auth=("af_YOUR_KEY", ""),
  )
  print(response.json())
  ```

  ```javascript Node.js theme={null}
  const response = await fetch("https://api.tryfuse.ai/api/v1/business/me", {
    headers: {
      Authorization: `Basic ${Buffer.from("af_YOUR_KEY:").toString("base64")}`,
    },
  });
  console.log(await response.json());
  ```
</CodeGroup>

### Raw token form

The header is also accepted with the raw key in place of the encoded credential:

```bash theme={null}
curl https://api.tryfuse.ai/api/v1/business/me \
  -H "Authorization: Basic af_YOUR_KEY"
```

Both forms resolve to the same key and behave identically. Use whichever your tooling produces; existing integrations using the raw form keep working.

## Authentication failures

| Status | Code | Meaning |
| - | - | - |
| `401` | `UNAUTHORIZED` | The key is missing, malformed, expired, or revoked. |
| `403` | `INSUFFICIENT_SCOPE` | The key is valid but not scoped for this endpoint — see [scopes](/concepts/scopes). |

Both come wrapped in the standard [error envelope](/concepts/errors), including a `request_id` you can quote to support.

## Key lifecycle

* Keys created in API Cockpit never expire. Revoke a key when you no longer need it.
* Revoking a key in API Cockpit takes effect immediately.
* Keys created in API Cockpit carry every [scope](/concepts/scopes), so they can call every endpoint. Choosing scopes or an expiry is not available in the app yet.
* The scheme must be written `Basic`, with a capital B.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.