> ## Documentation Index
> Fetch the complete documentation index at: https://docs.fetchbean.com/llms.txt
> Use this file to discover all available pages before exploring further.

# How to authenticate fetchbean API requests

> Every fetchbean request carries your API key in the X-API-Key header. Learn how to create, rotate, and secure your keys to protect your account.

fetchbean authenticates every request with your `fb_` API key, passed in the `X-API-Key` header. There are no per-provider credentials to manage — one key covers every provider and endpoint available through the gateway.

## Sending your key

Include your key in the `X-API-Key` header of every request:

```
X-API-Key: fb_your_key_here
```

<Warning>
  API keys are **not** accepted through the `Authorization` header. That header is reserved for the Firebase session token used by dashboard-only routes such as [Connections](/guides/byok-connections). Sending `Authorization: Bearer fb_…` returns `401 invalid_token`.
</Warning>

Here's a complete example:

```bash theme={null}
curl https://api.fetchbean.com/v1/search \
  -H "X-API-Key: $FETCHBEAN_KEY" \
  -H "Content-Type: application/json" \
  -d '{"query":"best vector databases"}'
```

## Managing keys

Create and revoke keys from **API Keys** in the [dashboard](https://fetchbean.com/app). Keep these rules in mind as you manage them:

* **Keys are shown once.** At creation, copy your key immediately — fetchbean only ever stores a hash, so it cannot be recovered or displayed again.
* **Use one key per app or environment.** Separate keys for production, staging, and development mean you can revoke one without disrupting the others.
* **Revocation is instant.** As soon as you revoke a key, all requests using it return `401`. There is no grace period.

## Securing your key

<Warning>
  Never commit an API key to source control or embed it in client-side code. Anyone who obtains your key can make billable calls on your account. If a key is exposed, revoke it immediately from the dashboard and issue a new one.
</Warning>

Store your key as an environment variable and read it at runtime:

```bash theme={null}
export FETCHBEAN_KEY=fb_your_key_here
```

Reference it in your code without hard-coding the value:

```javascript theme={null}
const key = process.env.FETCHBEAN_KEY;
```

```python theme={null}
import os
key = os.environ["FETCHBEAN_KEY"]
```

## Authentication errors

A missing or invalid key returns HTTP `401` with a typed error body:

```json theme={null}
{
  "error": {
    "type": "auth",
    "code": "invalid_key",
    "message": "invalid API key",
    "retryable": false,
    "billable": false
  }
}
```

The `billable: false` field confirms that authentication failures are never charged to your account. If you see a `401`, check that you copied the full key correctly and that the key hasn't been revoked.

<Tip>
  When using fetchbean with an MCP server, your key is configured once in the server settings — the agent itself never needs to handle it directly. See the [MCP guide](/guides/mcp) for setup instructions.
</Tip>