How to authenticate with the QWED API.
API keys
All requests require an API key.
SDK authentication
Environment variables
Set your API key as an environment variable:
Then the SDK will auto-detect it:
Security best practices
- Never commit API keys to version control
- Use environment variables in production
- Rotate keys regularly using the dashboard
- Set IP allowlists for production keys
- Use test keys for development
Agent authentication
Agent tokens are separate from API keys and are used for agent-specific endpoints.
Agent tokens are passed via the X-Agent-Token header:
Scopes
API keys can have restricted scopes:
Auth endpoints
The following endpoints manage user accounts and API keys via JWT-based authentication.
POST /auth/signup
Create a new user and organization. Returns a JWT token for immediate use.
Request:
Response:
POST /auth/signin
Sign in an existing user.
Request:
Response: Same format as /auth/signup.
GET /auth/me
Get the current authenticated user’s information. Requires a Bearer token in the Authorization header.
POST /auth/api-keys
Generate a new API key for the current user’s organization. Requires JWT authentication.
Request:
Response:
The key field is only returned once at creation time. Store it securely.
GET /auth/api-keys
List all active API keys for the current user’s organization.
DELETE /auth/api-keys/
Revoke an API key. Performs a soft delete.
Audit endpoints
These endpoints require JWT authentication (Bearer token) and return data scoped to the authenticated user’s organization.
GET /audit/logs
Get audit logs for the current organization.
GET /audit/logs/
Get detailed information for a single audit log entry.
GET /audit/export
Export audit logs as a CSV file (up to 1,000 records).