> ## Documentation Index
> Fetch the complete documentation index at: https://docs.fuseai.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Create an API key and authenticate every request with HTTP Basic auth.

Every request to the Fuse API is authenticated with an API key. Keys look like this:

```text theme={null}
af_3de1c09a4b2f48a1b7c2d5e6f7a8b9c0
```

## Create an API key

1. Open the Fuse app and go to **Settings → API Cockpit**.
2. Click **Create New Key**.
3. Copy the key immediately — the full value is shown **only once**, at creation. Afterwards the app displays a masked form (`af_3de1c09...b9c0`).

<Warning>
  Treat API keys like passwords. Never commit them to source control, embed them in client-side code, or share them in tickets. If a key leaks, revoke it in API Cockpit and create a new one — revocation is immediate.
</Warning>

## Use the key

The API uses HTTP Basic authentication and accepts **two equivalent forms** of the `Authorization` header.

### Standard Basic auth (recommended)

Send the key as the Basic-auth **username with an empty password**. This is standard [RFC 7617](https://www.rfc-editor.org/rfc/rfc7617) behavior, so every HTTP client and every SDK generated from our OpenAPI spec does it for you:

<CodeGroup>
  ```bash curl theme={null}
  curl https://api.tryfuse.ai/api/v1/business/me \
    -u "af_YOUR_KEY:"
  ```

  ```python Python theme={null}
  import requests

  response = requests.get(
      "https://api.tryfuse.ai/api/v1/business/me",
      auth=("af_YOUR_KEY", ""),
  )
  print(response.json())
  ```

  ```javascript Node.js theme={null}
  const response = await fetch("https://api.tryfuse.ai/api/v1/business/me", {
    headers: {
      Authorization: `Basic ${Buffer.from("af_YOUR_KEY:").toString("base64")}`,
    },
  });
  console.log(await response.json());
  ```
</CodeGroup>

### Raw token form

The header is also accepted with the raw key in place of the encoded credential:

```bash theme={null}
curl https://api.tryfuse.ai/api/v1/business/me \
  -H "Authorization: Basic af_YOUR_KEY"
```

Both forms resolve to the same key and behave identically. Use whichever your tooling produces; existing integrations using the raw form keep working.

## Authentication failures

| Status | Code                 | Meaning                                                                             |
| ------ | -------------------- | ----------------------------------------------------------------------------------- |
| `401`  | `UNAUTHORIZED`       | The key is missing, malformed, expired, or revoked.                                 |
| `403`  | `INSUFFICIENT_SCOPE` | The key is valid but not scoped for this endpoint — see [scopes](/concepts/scopes). |

Both come wrapped in the standard [error envelope](/concepts/errors), including a `request_id` you can quote to support.

## Key lifecycle

* Keys never expire by default; an optional expiry can be set at creation.
* Revoking a key in API Cockpit takes effect immediately.
* Keys are scoped at creation. A key with no explicit scopes has access to every endpoint; a scoped key is limited to its scopes ([details](/concepts/scopes)).