Authentication

Every call carries your key in the Authorization header, except GET /openapi.json and GET /operations, which you can read without a key. This page explains how the key travels, how to share keys between your tools and what happens when the API refuses it.

The Bearer header

A key starts with fd_live_. You send it in the Authorization header, after the word Bearer:

curl https://api.fitdistance.io/api/partner/v1/me \
  -H "Authorization: Bearer fd_live_xxxxxxxx"

Nothing else is added: no username, no password. The key says who is calling and what it may do, according to its scopes.

One key per tool

You can have five active keys. Give one to each tool: n8n, Make, a script, your AI. Each key has its own name and scopes. The Call log in the app shows which key did what: you see which tool uses your credits, and you cut one off without touching the others.

You do not edit the scopes of a key. To change them, create a new key, put it in the tool, then revoke the old one.

Revoke a key

In the app, open Settings › Integrations › API keys and revoke the key. It stops working within a minute, and its calls get a 401. Your other keys are not affected.

When the API refuses the key

A missing, unknown or revoked key gets a 401 UNAUTHORIZED:

{ "error": { "name": "PARTNER_API", "message": "UNAUTHORIZED" } }

A 401 costs no credit. Look first for a copy mistake: a missing character, or the word Bearer left out. A valid key that is not allowed to make the call does not get a 401 but a 403 SCOPE_MISSING.

Do not chain retries: repeated 401s from the same address are slowed down, and past 300 per minute you get a 429 RATE_LIMITED.

Keep the key secret

The full key is shown only once, when you create it. Fit'Distance does not store the full key: if you lose it, revoke it and create another.

To test a key without spending a credit, call GET /me: it is the subject of First call.