Skip to main content
How to authenticate with the QWED API.

API keys

All requests require an API key.

Header authentication

SDK authentication

Environment variables

Set your API key as an environment variable:
Then the SDK will auto-detect it:

API key format

Security best practices

  1. Never commit API keys to version control
  2. Use environment variables in production
  3. Rotate keys regularly using the dashboard
  4. Set IP allowlists for production keys
  5. Use test keys for development

Agent authentication

Agent tokens are separate from API keys and are used for agent-specific endpoints.
Agent tokens are passed via the X-Agent-Token header:

Scopes

API keys can have restricted scopes:

Auth endpoints

The following endpoints manage user accounts and API keys via JWT-based authentication.

POST /auth/signup

Create a new user and organization. Returns a JWT token for immediate use. Request:
Response:

POST /auth/signin

Sign in an existing user. Request:
Response: Same format as /auth/signup.

GET /auth/me

Get the current authenticated user’s information. Requires a Bearer token in the Authorization header.

POST /auth/api-keys

Generate a new API key for the current user’s organization. Requires JWT authentication. Request:
Response:
The key field is only returned once at creation time. Store it securely.

GET /auth/api-keys

List all active API keys for the current user’s organization.

DELETE /auth/api-keys/

Revoke an API key. Performs a soft delete.

Audit endpoints

These endpoints require JWT authentication (Bearer token) and return data scoped to the authenticated user’s organization.

GET /audit/logs

Get audit logs for the current organization.

GET /audit/logs/

Get detailed information for a single audit log entry.

GET /audit/export

Export audit logs as a CSV file (up to 1,000 records).