Documentación / API de la plataforma / Authentication

Authentication

How to make a website API key, how to send it on every request, and exactly how much of your account it can reach.

4 min de lectura All plans

There is one way in: a website API key, sent as a bearer token. There are no other credentials, no OAuth dance, and no session to keep alive.

Making a key

Open Settings → API Keys

You need to be an owner or an admin of the website you are making the key for.

Create a key and name it

Give it a name you will recognise later — the site or the plugin it is for.

Copy the secret straight away

It is shown once, at creation, and never again. QuQi stores only a scrambled copy of it, so nobody — including support — can read it back to you.

Paste it where it is needed

Into the QuQi plugin or app, or into your own code as an environment variable.

A key starts with quqi_ followed by a 40-character secret. The key list afterwards shows each key’s name, its first few characters, and whether it is active or revoked — never the whole thing again.

OJO If you lose the secret, you cannot recover it. Make a new key, put the new one in place, then revoke the old one.

Sending it

Put the key in an Authorization header, prefixed with Bearer. Every endpoint expects it, including the two POST ones.

CURL

curl https://console.quqi.io/api/v1/platform/status \
  -H "Authorization: Bearer quqi_YOUR_KEY"

A request with no bearer token comes back as 401 with Missing API key. Send it as an "Authorization: Bearer" header. A key that is wrong or has been revoked comes back as 401 with Invalid or revoked API key.

What a key can reach

A key belongs to exactly one website. Every response it can produce contains only that website’s connections, keywords and articles — there is no parameter that widens it, and no way to reach a second website with the same key.

QuQi records the time a key was last used on every successful call, though the key list does not show it.

Revoking a key

Revoke a key from the same screen you made it on. It stops working on the very next request — there is no grace period, and anything still using it starts failing immediately. That is the point: it is the switch you reach for when a key has leaked.

CONVIENE SABER Disconnecting from inside the plugin or the app is not the same as revoking. Disconnecting only forgets the connection; the key stays valid until you revoke it in the console.

¿Esta página ha respondido a su pregunta? Sí No del todo

Platform API

Status