API Authentication & Scopes
Authenticate your requests using high-entropy API secret keys with granular scope permissions.
1. Authentication Header
All requests to https://qrnaly.com/api/v1/* must include your API secret key in the Authorization header using the standard HTTP Bearer schema:
2. Key Formats & Environments
Standard API keys generated from Workspace Settings. Mutates workspace records, manages digital catalogues, allocates dynamic routes, and enforces plan quotas.
All REST API v1 operations execute against live production endpoints with authoritative validation. Simulated test keys (qrs_test_) are rejected.
3. Granular Scopes
API keys should be created following the principle of least privilege. Available scopes include:
| Scope | Description |
|---|---|
| qr:read | Retrieve QR code records, destinations, and vector SVG download URLs. |
| qr:write | Create new QR codes, update destination URLs post-print, and delete/archive codes. |
| folders:read | List and inspect organizational campaign folders. |
| folders:write | Create, update, and manage campaign folders. |
| templates:read | Retrieve custom QR styling templates. |
| templates:write | Create and update workspace QR styling templates. |
| catalogs:read | List and retrieve digital catalogues, restaurant menus, sections, items, and variants. |
| catalogs:write | Create, update, publish, duplicate, or delete digital catalogues, items, variants, and stock availability. |
| documents:read | List and retrieve metadata for hosted PDF menus, brochures, and image assets. |
| documents:write | Upload, replace, and delete platform-hosted PDF and image documents. |
| analytics:read | Access 30-day scan telemetry time series, device types, and city aggregations. |
4. Cryptographic Storage & Rotation
QRnaly never stores plaintext API keys in any database. Keys are hashed with SHA-256 before storage. If a key is compromised, administrators can instantly revoke or rotate it from the Dashboard with zero downtime.