Skip to content

Get started

Authentication

Every request carries an API key in the Authorization header:

Authorization: Bearer qrf_YOUR_KEY

Keys#

Create and revoke keys in the dashboard under API. The full key appears once, at creation; we store only a hash. The 12-character prefix identifies keys in the UI. Revoked keys fail with 401 unauthorized on the next request.

Preconditions#

  • Your account email must be verified. Calls from unverified accounts return 403 email_unverified.
  • API access starts with Starter. The 14-day Pro trial includes the API at the Pro quota; when a trial ends without a subscription the account returns to Free and calls return 403 plan_required.

Key handling#

Keys are secrets. Call the API from your server only; a key shipped in client-side code or a mobile app is public. Rotate by creating a second key, deploying it, then revoking the first: both work during the overlap.