> ## Documentation Index
> Fetch the complete documentation index at: https://docs.fusiondesk.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Authenticating FusionDesk REST API Requests with API Keys

> Generate an API key in FusionDesk settings and pass it as a Bearer token in the Authorization header to authenticate every API request.

FusionDesk authenticates API requests using API key–based Bearer token authentication. Every request you send must include a valid API key in the `Authorization` header. Requests made without a key, or with an invalid or revoked key, are rejected with an HTTP `401 Unauthorized` response. There are no session cookies or OAuth flows required — your API key is the single credential for all programmatic access.

## Generating an API key

<Steps>
  <Step title="Open API Keys settings">
    In FusionDesk, navigate to **Settings** in the left sidebar, then select **API Keys** from the settings menu.
  </Step>

  <Step title="Create a new key">
    Click **Create New Key**. Enter a descriptive name for the key — for example, `Production Integration` or `CI Pipeline` — so you can identify it later. Select the appropriate scope (see [API key scopes](#api-key-scopes) below).
  </Step>

  <Step title="Copy and store the key">
    After the key is created, FusionDesk displays it **once**. Copy it immediately and store it in a secure secrets manager or environment variable. You will not be able to view the full key again after closing this dialog.
  </Step>
</Steps>

<Warning>
  FusionDesk displays your API key only once at creation. If you lose it, you must revoke the key and generate a new one. Never store API keys in source code, version control, or any location accessible to unauthorized parties.
</Warning>

<Note>
  FusionDesk uses key prefixes to distinguish environments. Keys prefixed with `fd_test_` operate against your sandbox environment and do not affect production data. Keys prefixed with `fd_live_` interact with your live production environment. Always confirm you are using the correct key prefix before running scripts or deploying integrations.
</Note>

## Using the API key in requests

Include your API key as a Bearer token in the `Authorization` header of every request. Set `Content-Type: application/json` on requests that include a body.

<CodeGroup>
  ```bash cURL theme={null}
  curl -X GET https://api.fusiondesk.in/v1/tickets \
    -H "Authorization: Bearer fd_live_xxxxxxxxxxxxxxxxxxxx" \
    -H "Content-Type: application/json"
  ```

  ```javascript JavaScript theme={null}
  const response = await fetch('https://api.fusiondesk.in/v1/tickets', {
    headers: {
      'Authorization': 'Bearer fd_live_xxxxxxxxxxxxxxxxxxxx',
      'Content-Type': 'application/json'
    }
  });
  const data = await response.json();
  ```

  ```python Python theme={null}
  import requests

  response = requests.get(
      'https://api.fusiondesk.in/v1/tickets',
      headers={
          'Authorization': 'Bearer fd_live_xxxxxxxxxxxxxxxxxxxx',
          'Content-Type': 'application/json'
      }
  )
  data = response.json()
  ```
</CodeGroup>

## API key scopes

When you create a key, you assign it one of two permission scopes that control what it can do:

| Scope           | Description                                                                                                                                                                                                       |
| --------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Read-only**   | The key can perform `GET` requests to read resources (tickets, projects, users, reports). It cannot create, update, or delete any data. Use this scope for dashboards, analytics pipelines, and monitoring tools. |
| **Full access** | The key can perform all request methods — `GET`, `POST`, `PUT`, `PATCH`, and `DELETE`. Use this scope for integrations that need to create or modify data.                                                        |

Follow the principle of least privilege: assign read-only scope unless your integration explicitly requires write access.

## Rotating and revoking API keys

You should rotate API keys periodically and immediately if you suspect a key has been compromised.

**To rotate a key:**

1. Generate a new key in **Settings > API Keys** with the same name and scope as the existing key.
2. Update all services and integrations to use the new key.
3. Verify the new key is working correctly in all environments.
4. Revoke the old key by clicking **Revoke** next to it in the API Keys list.

**To revoke a key immediately:**
Select **Revoke** next to the key in **Settings > API Keys**. Revocation takes effect within seconds. Any request using the revoked key will receive an HTTP `401 Unauthorized` response.

<Warning>
  Never include API keys in client-side JavaScript, mobile app bundles, or any code that runs in a user's browser or device. Client-side code can be inspected and your key extracted. Always make API calls from a server-side environment where credentials remain private.
</Warning>