Refuel Ai Authentication

generated: '2026-08-14'
method: searched
source: openapi/refuel-ai-applications-api-openapi.yml, openapi/refuel-ai-cloud-api-openapi.yml
docs: https://docs.refuel.ai/sdk/python
summary:
  types:
  - http
  api_key_in:
  - header
  oauth2_flows: []
schemes:
- name: HTTPBearer
  type: http
  scheme: bearer
  description: >-
    A Refuel API key sent as an HTTP Bearer token: `Authorization: Bearer <REFUEL_API_KEY>`.
    One key per team; it is issued in the Refuel app. Refuel's own catalog documentation
    shows it in use against the label endpoint, and the Python SDK reads it from the
    REFUEL_API_KEY environment variable (or an `api_key` init option).
  sources:
  - openapi/refuel-ai-cloud-api-openapi.yml
  - openapi/refuel-ai-applications-api-openapi.yml
  - https://docs.refuel.ai/sdk/python
  applied_to: '99 of 108 operations in the Cloud API spec declare a HTTPBearer security requirement'
- name: BearerAuth
  type: http
  scheme: bearer
  description: >-
    The same credential, under the scheme name used in the older
    refuel-ai-applications-api-openapi.yml. Not a second mechanism.
  sources:
  - openapi/refuel-ai-applications-api-openapi.yml
  alias_of: HTTPBearer
key_management:
  issuance: In the Refuel app (https://app.refuel.ai) per team.
  rotation: Not documented.
  expiry: Not documented.
  scopes: none — the key is all-or-nothing across the team's data.
  exposure_note: >-
    The TeamSchema component includes `api_key` and `api_key_sha`, so
    `GET /team` returns the team's own API key in the response body. Any caller (or agent)
    with the key can re-read the key. Recorded as a governance fact for anyone delegating
    Refuel access to an agent — see agentic-access/refuel-ai-agentic-access.yml.
unauthenticated_behaviour:
  status: 401
  body: '{"message":"Unauthorized"}'
  scope: >-
    Every path on cloud-api.refuel.ai except `/` and `/openapi.json` — including
    `/.well-known/*`, `/docs`-adjacent paths and `/mcp`. Probed 2026-08-14.
  note: No operation in the spec declares a 401 response, despite this being the universal behaviour.
not_supported:
- oauth2
- openIdConnect
- mutualTLS
- apiKey-in-query
- basic-auth