Skip to content

Authentication

Send an API key in the X-Api-Key header:

X-Api-Key: qra_your_secret_value

Scopes

Scope Grants
qr:read List QR codes, retrieve details, and download PNG/SVG files.
qr:write Create and update QR codes, destinations, designs, and active status.
qr:delete Permanently delete QR codes.
analytics:read Read workspace and QR scan analytics.

Keys also require a plan that includes API access. Subscription eligibility is rechecked on every request, so cancelling or losing API entitlement stops key access without waiting for key expiry. The issuing user must also remain active, email-confirmed, enrolled in MFA, and an active workspace member.

Security lifecycle

  • Store keys in a managed secret store or protected server environment variable.
  • Use a separate key for each application and environment.
  • Set an expiry date and rotate before expiry.
  • Revoke a key immediately if it appears in logs, source control, client JavaScript, or support messages.
  • Never send a key in a query string.
  • Expect a key to stop authenticating immediately if its issuing user disables MFA or loses workspace access.

QRalto displays the full key once and stores only its SHA-256 hash. A lost key cannot be recovered; revoke it and create another.