Authentication
FabHub supports two models: API keys for tenant-owned automation, and OAuth for approved partner applications acting on a tenant's behalf.
API keys
Send the key on every request with the X-API-Key header (the Authorization: Bearer <key> form is also accepted):
curl https://api.fabhub.app/v1/items \
-H "X-API-Key: $FABHUB_API_KEY"
- Prefixes:
pk_test_*for non-production,pk_live_*for production. - Management: create, scope, and revoke keys under Settings -> Integrations -> API.
- Storage: the secret is shown once. Keep it server-side; rotate exposed keys and revoke unused ones.
Scopes
Keys carry least-privilege scopes. A request without the required scope returns 403 with code: "SCOPE_REQUIRED".
| Scope | Grants |
|---|---|
items:read | List and read items |
items:write | Create and update items |
orders:read | List orders |
contacts:read | List contacts |
organization:read | Read the organization profile |
usage:read | Read the API usage summary |
audit:read | Export audit events (Enterprise) |
webhooks:read | List and read webhook endpoints |
webhooks:write | Create and update webhook endpoints (Enterprise) |
webhooks:delete | Delete webhook endpoints |
webhooks:deliveries:read | Read webhook delivery attempts |
Inspecting a credential
GET /v1/auth/context returns the tenant, plan, scopes, rate-limit tier and expiry for the calling key. Use it for diagnostics and for failing fast when a scope is missing.
OAuth
OAuth is the partner-app model. Approved applications use Authorization Code with PKCE for user-mediated access, or Client Credentials for approved confidential machine-to-machine access.
Public endpoints:
GET /oauth/authorizePOST /oauth/tokenPOST /oauth/revoke
The token endpoint issues a scoped tenant API key (a pk_live_* / pk_test_* credential) returned as access_token with token_type: Bearer. Send it as Authorization: Bearer <token> or as X-API-Key. The API re-checks tenant, plan, app status, and scopes on every request, so revoked or downgraded access takes effect immediately.
Hosted MCP authorization
Hosted MCP requests use bearer credentials scoped to the public API resource. MCP tools map one-to-one to public API scopes, write tools require an explicit confirmation input, and credentials are not persisted by the MCP process.