> ## Documentation Index
> Fetch the complete documentation index at: https://docs.fortiseval.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> API keys, scopes, and rate limits

## API keys

Authenticate every request with a bearer token:

```bash theme={null}
curl https://api.fortiseval.com/v1/ping \
  -H "Authorization: Bearer sk-your-secret-key"
```

API keys belong to an **app** on your account. Create apps and keys in the
[Customer Portal](https://portal.fortiseval.com) under
**Account Settings → Custom Apps**:

* **Internal apps** authenticate with `sk-` API keys and access your own
  account's data. Most integrations want this.
* **Platform apps** are OAuth applications for building on Fortis on behalf of
  other accounts, using the OAuth 2.0 authorization code flow. Platform app
  creation is enabled per account — contact
  [support](mailto:support@fortiseval.com) to get access.

You can view your keys at any time from the app's details page in the portal.
Revoke a key at any time; revoked keys stop working immediately.

<Warning>
  Keep keys server-side. Never embed an API key in a browser, mobile app, or public
  repository.
</Warning>

## Scopes

Every endpoint requires a scope. API keys have access to all scopes by default.

| Scope             | Grants                                                 |
| ----------------- | ------------------------------------------------------ |
| `users:read`      | Read the users on your account                         |
| `quotes:read`     | Read your quotes                                       |
| `quotes:write`    | Create quotes                                          |
| `quotes:approve`  | Approve quotes, creating orders billed to your account |
| `orders:read`     | Read your orders                                       |
| `orders:write`    | Update your orders                                     |
| `documents:read`  | Read and download your documents                       |
| `files:read`      | Read your uploaded files                               |
| `files:write`     | Upload files                                           |
| `webhooks:manage` | Manage webhook endpoints                               |

A request missing a required scope returns `403`:

```json theme={null}
{ "message": "Insufficient scope.", "required_scopes": ["quotes:approve"] }
```

## Errors

| Status | Meaning                                                                                                          |
| ------ | ---------------------------------------------------------------------------------------------------------------- |
| `401`  | Missing, invalid, or revoked credentials                                                                         |
| `403`  | Authenticated, but missing a required scope                                                                      |
| `404`  | Resource not found (or belongs to another account)                                                               |
| `422`  | Validation failed — the body contains `errors` per field, and some endpoints add a machine-readable `error_code` |
| `429`  | Rate limit exceeded                                                                                              |

## Rate limits

Requests are limited to **120 per minute** per API key. When you exceed the
limit, the API returns `429` with a `Retry-After` header. If you need a higher
limit, contact [support](mailto:support@fortiseval.com).