API Authentication & Scopes
Authenticate your requests using high-entropy API secret keys with granular scope permissions.
1. Authentication Header
All requests to https://qrnaly.com/api/v1/* must include your API secret key in the Authorization header using the standard HTTP Bearer schema:
2. Key Formats & Environments
Used in production environments. Mutates live workspace records, allocates live shortlink routes, and consumes active QR credits.
Safe sandbox keys for CI/CD pipelines and local development testing without deducting live QR credits.
3. Granular Scopes
API keys should be created following the principle of least privilege. Available scopes include:
| Scope | Description |
|---|---|
| qr:read | Retrieve QR code records, destinations, and vector SVG download URLs. |
| qr:write | Create new QR codes, update destination URLs post-print, and delete/archive codes. |
| documents:read | List and retrieve metadata for hosted PDF menus, brochures, and image assets. |
| documents:write | Upload, replace, and delete platform-hosted PDF and image documents. |
| analytics:read | Access 30-day scan telemetry time series, device types, and city aggregations. |
4. Cryptographic Storage & Rotation
QRnaly never stores plaintext API keys in any database. Keys are hashed with SHA-256 before storage. If a key is compromised, administrators can instantly revoke or rotate it from the Dashboard with zero downtime.