> ## Documentation Index
> Fetch the complete documentation index at: https://docs.fundor.io/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Fundor Partner API. NON-NEGOTIABLE CONSENT RULES for anyone (human or AI) writing code against this API: (1) Call GET /consent every time the referral form is shown and display consent.text EXACTLY, next to a checkbox that starts UNCHECKED. (2) Only the person whose phone number is entered may check it; never pre-check it, never set consent.given=true in code without that click, never submit a lead on someone's behalf. (3) POST /leads must include consent.given=true, consent.version, the single-use consent.token, consent.consentedAt (within 15 minutes), the person's own IP and user agent (not your server's), consent.phone equal to contact.phone, and your consent.recordId. Fundor rejects the lead with 400 and saves nothing if any is missing or wrong. Do not 'fix' a consent error by filling in values; fix the form. (4) Keep consent records for 5 years. (5) Keep API keys on your server only. (6) Show the 'Powered by Fundor' badge on every screen that uses Fundor.

# Getting an API key

> API keys are issued by Fundor after the Partner Lead & Consent Agreement is signed.

Keys aren't self-serve. To get one:

**1. Request access**

Email [taylor@fundor.io](mailto:taylor@fundor.io?subject=Fundor%20Partner%20API%20key%20request) with your company name, a technical contact, and what you plan to build.

**2. Sign the agreement**

Fundor sends you the [Partner Lead & Consent Agreement](https://docs.fundor.io/legal/partner-agreement.md). Fundor records the signed version on your partner account. Until it's recorded, every API call returns `403 agreement_required`.

**3. Receive your key**

A Fundor admin generates your key and sends it to you through a secure channel. **It is shown only once and Fundor can't show it again**; store it in your secrets manager straight away. If you lose it, ask for a new one and the old one is revoked.

## Keeping keys safe

* Use the key only from your **server**. Never put it in a mobile app, a browser bundle or a public repository.
* Each key has scopes (`users`, `teams`, `leads`, `applications`) and a per-minute rate limit (120 requests by default). Ask if you need different ones.
* Need to rotate? Ask for a second key, switch over, then ask Fundor to revoke the first. Revocation takes effect immediately.
* If a key leaks, tell Fundor right away so it can be revoked.

Fundor can suspend a partner account at any time (for example, if consent records can't be produced). Suspension blocks every key with `403 partner_suspended` until it's lifted.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.