> ## Documentation Index
> Fetch the complete documentation index at: https://docs.getqr.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Create an API key and authenticate your requests.

> [!NOTE]
>
> The GetQR API is in beta and is available to selected workspaces. Details may change before the general release.

The GetQR API authenticates every request with your account API key. Each user has one key, and it acts as you in one workspace.

## Before you start

* You're the workspace owner or an editor. Viewers can't create or use an API key.
* The workspace owner has an active subscription.

## Create your API key

**1. Open your account settings**

Open your account settings and go to **API**.

**2. Generate the key**

Click **Generate API key**.

**3. Copy the key**

Reveal the key and copy it. Keys start with `sk_live_`.

You can reveal and copy the key again at any time. The settings also show when the key was created and when it was last used.

## Authenticate requests

Send the key as a Bearer token in the `Authorization` header of every request:

```bash theme={null}
curl "https://getqr.com/api/v1/qrs" \
  -H "Authorization: Bearer sk_live_..."
```

| Problem | Response |
| - | - |
| No `Authorization` header | `401 unauthorized`: "Missing Authorization header." |
| Header doesn't start with `Bearer ` | `400 bad_request`: "Misconfigured authorization header. Did you forget to add 'Bearer '?" |
| Unknown or regenerated key | `401 unauthorized`: "Unauthorized: Invalid API key." |
| Your role is viewer | `403 forbidden`: "API access is not available for this role." |
| The workspace owner's subscription isn't active | `403 forbidden`: "Access denied: This account does not have an active subscription." |
| The API isn't enabled for your workspace | `404 not_found`: "This endpoint is not available." |

The [health check](https://docs.getqr.com/api/endpoints/health.md) is the only endpoint that works without a key.

## Access and roles

* **Roles.** Only the workspace owner and editors can create and use an API key. Viewers can't.
* **Workspace.** Each key belongs to a single workspace, and every request runs in that workspace. You don't need to pass a workspace ID.
* **Live checks.** Access is checked on every request against your current role and the workspace owner's subscription. Your own subscription doesn't count. If your role changes to viewer or the owner's subscription ends, requests return `403` until access is restored. You don't need a new key.
* **Removal.** If you're removed from the workspace, your API key is deleted. If you're added back, generate a new key.

## Regenerate your key

Regenerate the key if it leaks or someone who shouldn't have it gets access.

> [!WARNING]
>
> Your current key stops working right away. Any app or integration using it breaks until you update it with the new key.

**1. Click Regenerate**

In your account settings, go to **API** and click **Regenerate**.

**2. Confirm**

Click **Regenerate key**.

**3. Update your apps**

Copy the new key and replace the old one everywhere you use it.

## Keep your key safe

Treat the key like a password: anyone who has it can create, change and delete QR codes in your workspace.

* Store it in an environment variable or a secrets manager, not in source code.
* Call the API only from your server. Never put the key in a website, mobile app or anything else users can inspect.
* Share it only with developers who need it.
* Regenerate it as soon as you suspect it leaked.

## Common issues

> [accordion] I get 401 with a key that used to work
>
> The key was regenerated, or you were removed from the workspace and the key was deleted. Copy the current key from your account settings, or generate a new one.

> [accordion] I get 403 on every request
>
> Check that your role is owner or editor, and that the workspace owner's subscription is active. The key works again as soon as access is restored.

> [accordion] I get 404 "This endpoint is not available."
>
> The API is in beta and isn't enabled for your workspace yet.

> [accordion] I don't see the API settings
>
> They appear only for the workspace owner and editors, and only in workspaces where the API is enabled.

## What's next

> [card] [API introduction](https://docs.getqr.com/api/introduction.md)

> [card] [Errors](https://docs.getqr.com/api/errors.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.