Authentication

Send your API key in the Authorization header as a bearer token. The header X-API-Key is accepted as well.

Authorization: Bearer qk_live_8YbN…

• Keys begin with qk_live_. We store only a keyed hash of each key, so a lost key cannot be shown again; create a new one and revoke the old one.
• The number of active keys depends on the plan (Free 1, Developer 2, Team 10).
• Keys belong to an account. Usage statistics are kept per key, so separate keys for separate systems make the figures easier to read.
• Never put a key in a web page or a mobile app. Call the API from your server.

A missing, unknown or revoked key gets 401 invalid_api_key.