Authentication

Overview

The Fentu FSM API uses token-based authentication. All API requests must include a valid authentication token in the request header.

Keep your API credentials secure. Never expose tokens in client-side code or public repositories.

Authentication Methods

API Key Authentication

For server-to-server integrations:

Authorization: Bearer YOUR_API_KEY

OAuth 2.0

For user-authorized applications:

Redirect user to authorization endpoint
User grants permission
Receive authorization code
Exchange code for access token
Use access token for API requests

Obtaining Credentials

API Keys

Navigate to Settings

Go to Administration > Integrations > API

Create API Key

Click “Create API Key”

Set Permissions

Configure what the key can access

Copy Key

Save the generated key securely

API keys are shown only once when created. Store them securely immediately. If lost, you must create a new key.

OAuth Credentials

For OAuth applications:

Register your application
Receive client ID and secret
Configure redirect URIs
Implement OAuth flow

Making Authenticated Requests

Request Headers

Include the authentication header in all requests:

curl -X GET "https://api.fentu.io/v1/work-orders" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json"

Example Request

const response = await fetch('https://api.fentu.io/v1/work-orders', {
  method: 'GET',
  headers: {
    'Authorization': 'Bearer YOUR_API_KEY',
    'Content-Type': 'application/json'
  }
});

Token Management

Token Expiration

Token Type	Lifetime
API Key	No expiration (until revoked)
Access Token	1 hour
Refresh Token	30 days

Refreshing Tokens

For OAuth access tokens:

POST /oauth/token
Content-Type: application/x-www-form-urlencoded

grant_type=refresh_token&
refresh_token=YOUR_REFRESH_TOKEN&
client_id=YOUR_CLIENT_ID&
client_secret=YOUR_CLIENT_SECRET

Revoking Tokens

To invalidate a token:

POST /oauth/revoke
Authorization: Bearer YOUR_TOKEN

Permissions & Scopes

Available Scopes

Scope	Access
`read:work-orders`	View work orders
`write:work-orders`	Create/update work orders
`read:customers`	View customers
`write:customers`	Create/update customers
`read:assets`	View assets
`write:assets`	Create/update assets
`admin`	Full administrative access

Requesting Scopes

Include scopes in authorization request:

https://api.fentu.io/oauth/authorize?
  client_id=YOUR_CLIENT_ID&
  redirect_uri=YOUR_REDIRECT&
  scope=read:work-orders write:work-orders&
  response_type=code

Error Handling

Authentication Errors

Error Code	Meaning	Resolution
`401`	Invalid or missing token	Check token and try again
`403`	Insufficient permissions	Request needed scopes
`429`	Rate limited	Wait and retry

Error Response Format

{
  "error": "unauthorized",
  "error_description": "Invalid or expired token",
  "status": 401
}

Rate Limiting

Limits

Tier	Requests/Hour
Standard	1,000
Professional	10,000
Enterprise	Unlimited

Rate Limit Headers

Responses include rate limit information:

X-RateLimit-Limit: 1000
X-RateLimit-Remaining: 999
X-RateLimit-Reset: 1640995200

Handling Rate Limits

When rate limited:

Check X-RateLimit-Reset header
Wait until reset time
Retry request
Consider caching responses

Security Best Practices

Secure Storage

Store credentials in secure vaults or environment variables. Never hardcode in source code.

Use HTTPS

Always use HTTPS for API requests. Never send credentials over unencrypted connections.

Minimum Scopes

Request only the scopes you need. Don’t request admin access for read-only operations.

Rotate Keys

Periodically rotate API keys. Immediately revoke any compromised credentials.

Monitor Usage

Monitor API usage for unusual patterns. Investigate unexpected spikes.

IP Restrictions

Where possible, restrict API access to known IP addresses.

API Introduction

API overview

Work Orders API

Work order endpoints

Customers API

Customer endpoints

Integrations

Integration setup

Getting Started

SERVICE APPS

WORK ORDER & JOBS

CUSTOMER MANAGEMENT

SERVICE MANAGEMENT

Products & Inventory

WORKFORCE

ADMINISTRATION

API REFERENCE

Overview

Authentication Methods

API Key Authentication

OAuth 2.0

Obtaining Credentials

API Keys

OAuth Credentials

Making Authenticated Requests

Request Headers

Example Request

Token Management

Token Expiration

Refreshing Tokens

Revoking Tokens

Permissions & Scopes

Available Scopes

Requesting Scopes

Error Handling

Authentication Errors

Error Response Format

Rate Limiting

Limits

Rate Limit Headers

Handling Rate Limits

Security Best Practices

API Introduction

Work Orders API

Customers API

Integrations

​Overview

​Authentication Methods

​API Key Authentication

​OAuth 2.0

​Obtaining Credentials

​API Keys

​OAuth Credentials

​Making Authenticated Requests

​Request Headers

​Example Request

​Token Management

​Token Expiration

​Refreshing Tokens

​Revoking Tokens

​Permissions & Scopes

​Available Scopes

​Requesting Scopes

​Error Handling

​Authentication Errors

​Error Response Format

​Rate Limiting

​Limits

​Rate Limit Headers

​Handling Rate Limits

​Security Best Practices

​Related Documentation

API Introduction

Work Orders API

Customers API

Integrations

Overview

Authentication Methods

API Key Authentication

OAuth 2.0

Obtaining Credentials

API Keys

OAuth Credentials

Making Authenticated Requests

Request Headers

Example Request

Token Management

Token Expiration

Refreshing Tokens

Revoking Tokens

Permissions & Scopes

Available Scopes

Requesting Scopes

Error Handling

Authentication Errors

Error Response Format

Rate Limiting

Limits

Rate Limit Headers

Handling Rate Limits

Security Best Practices

Related Documentation