Authentication

Create an API key in the dashboard and send it with every request.

The API uses workspace API keys. A key acts for one workspace and for the person who created it.

Create a key

You need a paid plan (Starter, Pro or Business), and you must be an owner or admin of the workspace (members who can delete codes).

  1. In the dashboard, open Integrations in the sidebar.
  2. In the API keys card, type a name for the key, for example "Website CMS", and click Create key.
  3. The new key is shown once under New API key. Copy it now. You can't see it again later.

Keys start with qrm_live_. The table in the API keys card lists each key by name, the first characters of the key, and when it was last used.

Send the key

Put the key in the Authorization header:

Authorization: Bearer qrm_live_your_key

The X-API-Key header also works:

X-API-Key: qrm_live_your_key

Keep keys on your server. Anyone with a key can create and change codes in your workspace.

When a key stops working

A request returns 401 with the code UNAUTHORIZED when:

  • the key is wrong, or it was revoked;
  • the person who created the key has left the workspace, or is no longer an owner or admin;
  • the workspace is back on Free.

Revoke a key

Open Integrations, find the key in the API keys card and click Revoke, then confirm. Anything using the key stops working straight away.

Keys named "MCP: …" belong to AI assistants connected through the MCP server. Revoking one disconnects that assistant.