# Getting started

This page takes you from nothing to your first successful request.

## 1. Get API access

Fulfillbot turns API access on per account. Ask your account manager. When it is on, the portal shows **Settings → API access**.

## 2. Create an API key

1. Sign in to the portal and open **Settings → API access**.
2. Under **Create an API key**, enter a name for the key (up to 60 characters), for example the system that will use it.
3. Choose an access level (see the table below). With **Custom** you tick the permissions yourself.
4. Click **Create API key** and copy the key straight away. It is shown only once; we keep only a hash of it.

| Access level | Permissions |
|---|---|
| Read only | `wallet:read`, `catalog:read`, `orders:read`, `purchase_orders:read`, `shipments:read`, `requests:read`, `quotes:read` |
| Read and create orders | `wallet:read`, `catalog:read`, `orders:read`, `purchase_orders:read`, `shipments:read`, `requests:read`, `quotes:read`, `orders:write` |
| Custom | The ones you tick |

When a key can create orders, the portal shows a note about charges first: read [Charges and your wallet](https://docs.rephut.com/developers/charges).

For your security you must have signed in within the last 10 minutes to create a key; otherwise the portal asks you to sign in again. Keys can't be created while your account is on hold. An account can have up to 10 active keys; revoke one you no longer use to add another.

## 3. Store the key safely

Keys start with `pak_`. Treat a key like a password: anyone who has it can use your account within its permissions. Keep it in an environment variable or a secrets manager, never in source code, a web page or a mobile app. The examples in these docs read it from `FULFILLBOT_API_KEY`:

```bash
export FULFILLBOT_API_KEY="pak_..."
```

If a key leaks, revoke it in **Settings → API access**. It stops working at once. Then create a new one.

## 4. Make your first request

[`GET /v1/me`](https://docs.rephut.com/developers/reference/account#get-the-customer-and-api-key-for-this-request) works with any valid key and tells you which account and key a request uses.

```bash example=curl
curl 'https://api.rephut.com/v1/me' \
  -H "Authorization: Bearer $FULFILLBOT_API_KEY"
```

```js example=node
const response = await fetch("https://api.rephut.com/v1/me", {
  headers: {
    Authorization: `Bearer ${process.env.FULFILLBOT_API_KEY}`,
  },
});
const result = await response.json();
console.log(response.status, result);
```

```python example=python
import os

import requests

response = requests.get(
    "https://api.rephut.com/v1/me",
    headers={
        "Authorization": f"Bearer {os.environ['FULFILLBOT_API_KEY']}",
    },
    timeout=30,
)
print(response.status_code, response.json())
```

```json example=response status=200
{
  "success": true,
  "data": {
    "customer": {
      "id": "cm2x8k1p40000abcd1234wxyz",
      "name": "Northwind Goods"
    },
    "apiKey": {
      "id": "cm3a1b2c30000keyd5678abcd",
      "name": "Order sync",
      "keyPrefix": "pak_7Hq2Lm9X",
      "scopes": [
        "wallet:read",
        "catalog:read",
        "orders:read",
        "purchase_orders:read",
        "shipments:read",
        "requests:read",
        "quotes:read",
        "orders:write"
      ]
    }
  }
}
```

The Node.js examples need Node.js 18 or later (built-in `fetch`, top-level `await`; save them as `.mjs`). The Python examples use the `requests` package (`pip install requests`).

If you get `401 invalid_api_key`, check that the header is exactly `Authorization: Bearer <key>`. If you get `403 api_not_enabled`, API access is off for your account. See [Authentication](https://docs.rephut.com/developers/authentication).

## 5. Next steps

- [Authentication](https://docs.rephut.com/developers/authentication): permissions and why a key can be refused.
- [Errors](https://docs.rephut.com/developers/errors), [Rate limits](https://docs.rephut.com/developers/rate-limits) and [Idempotency](https://docs.rephut.com/developers/idempotency) before you write.
- [Charges and your wallet](https://docs.rephut.com/developers/charges) before you create orders.
- [Webhooks](https://docs.rephut.com/developers/webhooks) so you don't need to poll.
- [From order to delivery](https://docs.rephut.com/developers/guides/order-to-shipment) for a complete walk-through.