> ## Documentation Index
> Fetch the complete documentation index at: https://docs.fanhaven.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> API key Bearer authentication, scopes, and key management.

Every public API request must include a Fanhaven API key. There is no session or OAuth flow for this surface.

## API keys

Create, revoke, and delete keys from **Settings → API → API Keys**.

* Format: `fh_live_` followed by a random secret
* Shown **once** at creation
* Bound to the artist and tour selected in the dashboard
* Optional **scopes** limit which resources the key can access

<Warning>Keep keys on a server. Do not embed them in a website, mobile app, or source control.</Warning>

## Header

```
Authorization: Bearer fh_live_...
```

Missing or invalid keys return `401` with code `unauthorized`.

## Scopes

| Scope               | Access                          |
| ------------------- | ------------------------------- |
| `fans:read`         | List and retrieve fans          |
| `transactions:read` | List and retrieve sales         |
| `events:read`       | List and retrieve tour dates    |
| `merch:read`        | List and retrieve catalog items |

A request that needs a scope the key does not have returns `403`.

Keys created without an explicit scope list receive all of the scopes above.

## Revoke vs delete

* **Revoke** immediately invalidates the secret. The row stays in the list.
* **Delete** removes the key record.

Revoked keys cannot be restored. Issue a new key and update your integration first.