Skip to content

Get started

Authentication

Every request carries an API key in the Authorization header:

Authorization: Bearer qrf_YOUR_KEY

Keys#

Create and revoke keys in the dashboard under API. The full key appears once, at creation; we store only a hash. The 12-character prefix identifies keys in the UI. Revoked keys fail with 401 unauthorized on the next request.

Check a key#

GET /api/v1/me answers with the account the key belongs to, its effective plan, and whether scan webhooks are available:

{ "data": { "id": "…", "email": "sam@example.com", "name": "Sam",
            "plan": "pro", "webhooks": true } }

Building an integration?#

Send X-QRvora-Client: yourapp/1.0.0with every request. It isn't required, but it lets us see which integration an account uses when helping with support.

Preconditions#

  • Your account email must be verified. Calls from unverified accounts return 403 email_unverified.
  • API access starts with Starter. The 7-day Pro trial includes the API at the Pro quota; when a trial ends without a subscription the account returns to Free and calls return 403 plan_required.

Key handling#

Keys are secrets. Call the API from your server only; a key shipped in client-side code or a mobile app is public. Rotate by creating a second key, deploying it, then revoking the first: both work during the overlap.