# Authentication

API keys, the Authorization header, revocation and key limits.

HTML version: https://fundfactsapi.com/docs/authentication · Updated 2026-09-30

## 2. Setup and the API key

The key is **not** in this file. It is read from the environment variable `FUNDFACTS_API_KEY`.

- If it is not set, ask the user for their FundFacts API key (it starts with `ffk_`, created at https://fundfactsapi.com/dashboard) and store it in `.env` / `.env.local`, which must be listed in `.gitignore`.
- Never print the key in logs, commit it, or ship it to a browser bundle. Calls must go through server-side code or a backend route.

Authentication is a bearer token on every request (`X-Api-Key: <key>` is accepted as well):

```bash
curl -s https://fundfactsapi.com/api/v1/funds/IE00B4L5Y983 -H "Authorization: Bearer $FUNDFACTS_API_KEY"
```

Full reference: https://fundfactsapi.com/llms-full.txt