Authenticating FusionDesk REST API Requests with API Keys

FusionDesk authenticates API requests using API key–based Bearer token authentication. Every request you send must include a valid API key in the Authorization header. Requests made without a key, or with an invalid or revoked key, are rejected with an HTTP 401 Unauthorized response. There are no session cookies or OAuth flows required — your API key is the single credential for all programmatic access.

Generating an API key

Open API Keys settings

In FusionDesk, navigate to Settings in the left sidebar, then select API Keys from the settings menu.

Create a new key

Click Create New Key. Enter a descriptive name for the key — for example, Production Integration or CI Pipeline — so you can identify it later. Select the appropriate scope (see API key scopes below).

Copy and store the key

After the key is created, FusionDesk displays it once. Copy it immediately and store it in a secure secrets manager or environment variable. You will not be able to view the full key again after closing this dialog.

FusionDesk displays your API key only once at creation. If you lose it, you must revoke the key and generate a new one. Never store API keys in source code, version control, or any location accessible to unauthorized parties.

FusionDesk uses key prefixes to distinguish environments. Keys prefixed with fd_test_ operate against your sandbox environment and do not affect production data. Keys prefixed with fd_live_ interact with your live production environment. Always confirm you are using the correct key prefix before running scripts or deploying integrations.

Using the API key in requests

Include your API key as a Bearer token in the Authorization header of every request. Set Content-Type: application/json on requests that include a body.

curl -X GET https://api.fusiondesk.in/v1/tickets \
  -H "Authorization: Bearer fd_live_xxxxxxxxxxxxxxxxxxxx" \
  -H "Content-Type: application/json"

const response = await fetch('https://api.fusiondesk.in/v1/tickets', {
  headers: {
    'Authorization': 'Bearer fd_live_xxxxxxxxxxxxxxxxxxxx',
    'Content-Type': 'application/json'
  }
});
const data = await response.json();

import requests

response = requests.get(
    'https://api.fusiondesk.in/v1/tickets',
    headers={
        'Authorization': 'Bearer fd_live_xxxxxxxxxxxxxxxxxxxx',
        'Content-Type': 'application/json'
    }
)
data = response.json()

API key scopes

When you create a key, you assign it one of two permission scopes that control what it can do:

Scope	Description
Read-only	The key can perform `GET` requests to read resources (tickets, projects, users, reports). It cannot create, update, or delete any data. Use this scope for dashboards, analytics pipelines, and monitoring tools.
Full access	The key can perform all request methods — `GET`, `POST`, `PUT`, `PATCH`, and `DELETE`. Use this scope for integrations that need to create or modify data.

Follow the principle of least privilege: assign read-only scope unless your integration explicitly requires write access.

Rotating and revoking API keys

You should rotate API keys periodically and immediately if you suspect a key has been compromised. To rotate a key:

Generate a new key in Settings > API Keys with the same name and scope as the existing key.
Update all services and integrations to use the new key.
Verify the new key is working correctly in all environments.
Revoke the old key by clicking Revoke next to it in the API Keys list.

To revoke a key immediately: Select Revoke next to the key in Settings > API Keys. Revocation takes effect within seconds. Any request using the revoked key will receive an HTTP 401 Unauthorized response.

Never include API keys in client-side JavaScript, mobile app bundles, or any code that runs in a user’s browser or device. Client-side code can be inspected and your key extracted. Always make API calls from a server-side environment where credentials remain private.

Overview

Endpoints

Authenticating FusionDesk REST API Requests with API Keys

Generating an API key

Using the API key in requests

API key scopes

Rotating and revoking API keys

​Generating an API key

​Using the API key in requests

​API key scopes

​Rotating and revoking API keys

Generating an API key

Using the API key in requests

API key scopes

Rotating and revoking API keys