> ## Documentation Index
> Fetch the complete documentation index at: https://docs.fleeticc.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Sign Partner API requests with your API key and secret

The Partner API does not use email/password login. You authenticate with an **API key** and a **request signature**.

Generate keys on the Fleeticc website → **Partner API** (owner only), after Fleeticc enables access.

## Headers on every request

**X-Api-Key** `string` *required*

Your public API key (`pk_…`)

**X-Timestamp** `string` *required*

Current Unix time in seconds

**X-Signature** `string` *required*

HMAC-SHA256 hex of the canonical string (see below)

Your server clock should stay accurate. Timestamps more than **5 minutes** off are rejected.

## How to build the signature

1. Build this text (four lines, joined by newlines):

```text theme={null}
GET
/api/partner/v1/vehicles
1710000000
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
```

| Line | Value |
| - | - |
| 1 | HTTP method in uppercase (`GET`) |
| 2 | Full path **including** query string (starts with `/api/…`) |
| 3 | Same number as `X-Timestamp` |
| 4 | SHA-256 hash of the body (for GET, hash of an empty body) |

2. Sign that text with **HMAC-SHA256** using your **secret**
3. Send the result as hex in `X-Signature`

## Example (Node.js)

```javascript theme={null}
const crypto = require('crypto');

function sign({ method, path, timestamp, body, secret }) {
  const bodyHash = crypto.createHash('sha256').update(body || '').digest('hex');
  const stringToSign = [method.toUpperCase(), path, String(timestamp), bodyHash].join('\n');
  return crypto.createHmac('sha256', secret).update(stringToSign).digest('hex');
}

const timestamp = Math.floor(Date.now() / 1000);
const path = '/api/partner/v1/vehicles';
const signature = sign({
  method: 'GET',
  path,
  timestamp,
  body: '',
  secret: process.env.FLEETICC_API_SECRET,
});

// GET https://api.fleeticc.com/api/partner/v1/vehicles
// X-Api-Key: your_api_key
// X-Timestamp: timestamp
// X-Signature: signature
```

## Request example (curl)

```bash theme={null}
export PATH="/usr/bin:/bin:/usr/sbin:/sbin:/opt/homebrew/bin:$PATH"
KEY="$FLEETICC_API_KEY"
SECRET="$FLEETICC_API_SECRET"
REQ_PATH="/api/partner/v1/vehicles"
TS=$(date +%s)
BODY_HASH=$(printf '' | openssl dgst -sha256 -hex | awk '{print $NF}')
SIG=$(printf 'GET\n%s\n%s\n%s' "$REQ_PATH" "$TS" "$BODY_HASH" | openssl dgst -sha256 -hmac "$SECRET" -hex | awk '{print $NF}')

curl -sS -X GET "https://api.fleeticc.com$REQ_PATH" \
  -H "X-Api-Key: $KEY" \
  -H "X-Timestamp: $TS" \
  -H "X-Signature: $SIG"
```

On macOS, use `awk '{print $NF}'` (not `$2`) so the OpenSSL hex hash is read correctly. Do **not** set a shell variable named `PATH` to the API path — that breaks system commands.

## Tips

* Always sign the **exact** path you request (including `?imeis=…` if present)
* Keep the secret on your backend only
* Rotate or revoke keys from the Fleeticc website → **Partner API** (owner only). After rotate, update your server with the new secret immediately.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.