> ## Documentation Index
> Fetch the complete documentation index at: https://docs.facetflux.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Every request is authenticated with a tenant-scoped API key sent as a Bearer token.

FacetFlux authenticates API and MCP requests with an **API key** sent in the `Authorization` header:

```
Authorization: Bearer <your-api-key>
```

Every key belongs to a single tenant, and every response is scoped to that tenant's data. There is no separate account ID to send — the key identifies the tenant.

## Creating a key

1. Sign in at [app.facetflux.com](https://app.facetflux.com) as a tenant admin.
2. Go to **Settings → API keys**.
3. Click **Create new key**, give it a name, and choose a permission level (see below).
4. Copy the key immediately — it's shown **once** and cannot be retrieved later. Only the last four characters are visible afterward.

<Warning>
  Treat API keys like passwords. A key grants access to your entire tenant's catalog within its permission level. If a key leaks, delete it from **Settings → API keys** and mint a new one.
</Warning>

## Permission levels

When you create a key you pick what it's allowed to do. This is enforced on both the REST API and the MCP server.

| Permission       | Can read | Can write | Use it for                                                           |
| ---------------- | -------- | --------- | -------------------------------------------------------------------- |
| **Read-only**    | Yes      | No        | Sync catalog data out, dashboards, reporting, read-only agents.      |
| **Read & write** | Yes      | Yes       | Integrations that push products, run enrichment, or trigger exports. |
| **Admin**        | Yes      | Yes       | Automation that also manages tenant settings.                        |

A **read-only** key can only make `GET` requests on the REST API; any mutating call returns `403` with `read_only_api_key`. On the MCP server, read-only keys can call read tools but mutating tools return a `read_only_key` error. Choose the narrowest permission that does the job.

## Using the key

<CodeGroup>
  ```bash cURL theme={null}
  curl https://app.facetflux.com/api/v1/public/products \
    -H "Authorization: Bearer $FACETFLUX_API_KEY"
  ```

  ```python Python theme={null}
  import os, requests

  resp = requests.get(
      "https://app.facetflux.com/api/v1/public/products",
      headers={"Authorization": f"Bearer {os.environ['FACETFLUX_API_KEY']}"},
  )
  resp.raise_for_status()
  print(resp.json())
  ```

  ```typescript TypeScript theme={null}
  const resp = await fetch("https://app.facetflux.com/api/v1/public/products", {
    headers: { Authorization: `Bearer ${process.env.FACETFLUX_API_KEY}` },
  });
  if (!resp.ok) throw new Error(`${resp.status} ${await resp.text()}`);
  console.log(await resp.json());
  ```
</CodeGroup>

<Tip>
  Keep keys out of source control. Read them from an environment variable or a secrets manager, as the examples above do.
</Tip>