> ## Documentation Index
> Fetch the complete documentation index at: https://docs.fundingperpetuals.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate requests with a Funding Perpetuals API key.

Send your API key in the HTTP `Authorization` header with the `Bearer` scheme:

```http theme={null}
Authorization: Bearer fp_live_...
```

API keys currently have one scope: full read and trading access to every challenge
account owned by the Funding Perpetuals user who created the key. The API
information and tradable-market catalog endpoints are public; account state,
quotes, positions, and orders require a key.

## Keep keys server-side

API keys are long-lived credentials. Store them in a secret manager or an
encrypted environment registry. Do not commit a key, print it in logs, include
it in a URL, or ship it in frontend code.

Production keys begin with `fp_live_`. Keys created in development or preview
deployments begin with `fp_test_` and cannot authenticate against production
because each environment has a separate credential database.

## Rotate a key

Create a replacement key, update your client, confirm it can make an
authenticated read, and then revoke the old key in
[API Key Settings](https://fundingperpetuals.com/settings?section=api-keys).
Revocation takes effect for new requests immediately; a request already in
flight may still finish.