> ## Documentation Index
> Fetch the complete documentation index at: https://docs.fluidehr.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Auth quickstart

> Exchange developer credentials for a JWT and verify your integration is authorized.

# Auth quickstart

Get authorized in a few minutes. This guide assumes you already have API credentials from the Connect dashboard (**API Keys**).

<Note>
  New to Fluide Connect? Complete email verification in the dashboard first. Your `apiKey` and one-time `apiSecret` are provisioned automatically.
</Note>

## Prerequisites

| Variable            | Example                                                  |
| ------------------- | -------------------------------------------------------- |
| `FLUIDE_BASE_URL`   | `https://test.api.fluidehr.com`                          |
| `FLUIDE_API_KEY`    | `fl_dev_...`                                             |
| `FLUIDE_API_SECRET` | From Connect at provisioning (store in a secret manager) |

See [Environments](/getting-started/environments) for staging vs production base URLs.

## 1. Exchange credentials for a JWT

Send your API key and secret **only** to the token endpoint. Never include the secret on product routes.

<CodeGroup>
  ```bash curl theme={null}
  export FLUIDE_BASE_URL="https://test.api.fluidehr.com"

  curl -X POST "$FLUIDE_BASE_URL/api/v1/authorize/token" \
    -H "X-Fluide-Api-Key: $FLUIDE_API_KEY" \
    -H "X-Fluide-Api-Secret: $FLUIDE_API_SECRET" \
    -H "X-Fluide-Client-Id: fluide-developer"
  ```

  ```javascript Node.js theme={null}
  const baseUrl = process.env.FLUIDE_BASE_URL ?? 'https://test.api.fluidehr.com';

  const res = await fetch(`${baseUrl}/api/v1/authorize/token`, {
    method: 'POST',
    headers: {
      'X-Fluide-Api-Key': process.env.FLUIDE_API_KEY!,
      'X-Fluide-Api-Secret': process.env.FLUIDE_API_SECRET!,
      'X-Fluide-Client-Id': 'fluide-developer',
    },
  });

  if (!res.ok) throw new Error(`Token exchange failed: ${await res.text()}`);
  const { accessToken, exp } = await res.json();
  ```
</CodeGroup>

Save `accessToken` and refresh before `exp`. The API secret is used **only** for this call.

## 2. Confirm your developer session

With a valid token, fetch credential metadata (no secret is returned):

<CodeGroup>
  ```bash curl theme={null}
  curl -X GET "$FLUIDE_BASE_URL/api/v1/authorize/current" \
    -H "Authorization: Bearer $FLUIDE_ACCESS_TOKEN" \
    -H "X-Fluide-Client-Id: fluide-developer"
  ```

  ```javascript Node.js theme={null}
  const res = await fetch(`${baseUrl}/api/v1/authorize/current`, {
    headers: {
      Authorization: `Bearer ${accessToken}`,
      'X-Fluide-Client-Id': 'fluide-developer',
    },
  });

  if (!res.ok) throw new Error(`Current credentials failed: ${await res.text()}`);
  const credentials = await res.json();
  ```
</CodeGroup>

## 3. Call a product API

Every product request needs **both** the Bearer token and your API key:

<CodeGroup>
  ```bash curl theme={null}
  curl -X GET "$FLUIDE_BASE_URL/api/v1/hr/health" \
    -H "Authorization: Bearer $FLUIDE_ACCESS_TOKEN" \
    -H "X-Fluide-Api-Key: $FLUIDE_API_KEY" \
    -H "X-Fluide-Client-Id: fluide-developer"
  ```

  ```javascript Node.js theme={null}
  const res = await fetch(`${baseUrl}/api/v1/hr/health`, {
    headers: {
      Authorization: `Bearer ${accessToken}`,
      'X-Fluide-Api-Key': process.env.FLUIDE_API_KEY!,
      'X-Fluide-Client-Id': 'fluide-developer',
    },
  });

  if (!res.ok) throw new Error(`HTTP ${res.status}: ${await res.text()}`);
  ```
</CodeGroup>

<Warning>
  Do not send `X-Fluide-Api-Secret` on HR, payroll, payments, or other product routes.
</Warning>

## Next steps

<CardGroup cols={2}>
  <Card title="Authorization guide" icon="key" href="/getting-started/authorization">
    Full token exchange, rotation, and header reference.
  </Card>

  <Card title="First request" icon="rocket" href="/getting-started/first-request">
    End-to-end walkthrough with caching and error handling.
  </Card>

  <Card title="Auth API reference" icon="code" href="/api-reference/auth">
    OpenAPI operations for developer access and health checks.
  </Card>

  <Card title="Auth overview" icon="book" href="/auth/overview">
    Credential lifecycle and how authentication works across products.
  </Card>
</CardGroup>