The REST API and webhooks are already available
Create QR codes and short links from your systems with API keys and scopes.
- Keys use the qrw_live_ prefix
- 300 requests per minute per key
- Webhooks for link changes
curl -X POST https://app.smartqrcodes.io/api/v1/qr-codes \ -H "Authorization: Bearer qrw_live_YOUR_KEY" \ -H "Content-Type: application/json" \ -d '{ "title": "Autumn menu", "type": "URL", "content": "https://cafe.example/menu", "isDynamic": true, "slug": "autumn" }'→ 201 Created{ "id": "8b1e27d3-2b57-4b6f-b6c4-a9f6cf79ea31", "shortLink": { "slug": "autumn" }, "isActive": true }
An API key is limited by its selected scopes. Save the full secret when the key is issued.
Feature availability
What works today
/api/v1 uses qrw_live_… API keys with Bearer authentication and scopes. The limit is 300 requests per minute for each key.
Keys use the qrw_live_ prefix
The full secret is shown only on creation or rotation of the key. Save it right away in secure storage, and if the secret is lost, rotate the key.
300 requests per minute per key
API-key scopes define the available resources and operations. Every request is checked separately.
Webhooks for link changes
Create QR codes and short links from your systems with API keys and scopes.
What the current API gives you
API-key scopes define the available resources and operations. Every request is checked separately.
Scoped authentication
Pass the key as Authorization: Bearer qrw_live_…; it reaches only the resources and operations it is allowed to.
Mini-sites and projects
Separate read and write scopes let you give an integration only the rights it needs.
Request isolation
Every request is authorized independently against the API key and its scopes.
Key lifecycle
A key can be created, configured, rotated and revoked; the full secret is never returned in the key list.
Where the documentation ends
The route reference and request examples are in your dashboard; OpenAPI files, an official SDK and client libraries are not published yet.
The key secret is shown once
Rotation revokes the previous key and issues a replacement, while revocation stops any further authorization with that key.
Bearer authentication with an API key
Send a key with the qrw_live_… prefix in the Authorization: Bearer header. Scopes limit the available operations, and each key is limited to 300 requests per minute.
- Creating, reviewing and configuring API keys
- Key rotation and revocation
- One-time display of the full secret
- Authorization: Bearer qrw_live_…
Authorization: Bearer qrw_live_YOUR_KEY
The full secret is shown only on creation or rotation of the key. Save it right away in secure storage, and if the secret is lost, rotate the key.
API request contract
The table lists the required parameters of the current external API.
| API request contract | Requirement | Current API |
|---|---|---|
| Authentication | API key | Bearer qrw_live_… |
| Header | Authorization | Bearer qrw_live_… |
| Access control | API-key scopes | Checked on every request |
| Request limit | Per API key | 300 requests per minute |
- Authentication
- Requirement
- API key
- Current API
- Bearer qrw_live_…
- Header
- Requirement
- Authorization
- Current API
- Bearer qrw_live_…
- Access control
- Requirement
- API-key scopes
- Current API
- Checked on every request
- Request limit
- Requirement
- Per API key
- Current API
- 300 requests per minute
Quick start
How to connect a server-side integration
Create a key with the fewest rights possible, save the secret that is shown once and pass it only from a trusted environment.
- 1
Create a key
Obtain a key for the server integration, set the minimum required scopes and store the secret in a protected location.
- 2
Pick the scopes
Leave only the read and write rights the integration really needs.
- 3
Save the secret
Copy the secret right away: it is never shown again. If it is lost, rotate the key.
- 4
Send the header
Use Authorization: Bearer qrw_live_… on a supported /api/v1 route.
FAQ
Frequently asked questions
What does an API key look like?
A key starts with qrw_live_…. Keep the full secret in a protected server environment and never expose it in client code.
How do I pass the API key?
Pass the key in the Authorization header as a Bearer credential or in the X-API-Key header. Access is limited by the key scopes.
What request limit applies?
Each API key is limited to 300 requests per minute.
Which events do webhooks send?
Webhooks are sent when a short link is created, updated or deleted: link.created, link.updated and link.deleted.
Create a key for your server-side integration
Pick the minimum scopes, save the secret when it is issued and use it only in a trusted environment.