Skip to main content
The Developer API is in limited beta. An API key belongs to one Qoory user and uses that user’s Developer access and credit balance.

​
Bearer authentication

Send the secret in the Authorization header on every REST and remote MCP request:
Qoory never accepts API keys in URLs. Query strings can be recorded by browsers, proxies, and analytics systems.

​
Scopes

Choose the narrowest scopes the integration needs. A valid key without the required scope receives FORBIDDEN and does not gain access through MCP or a Skill.

​
Key lifecycle

  1. Create: name the key for one environment or integration and select its scopes.
  2. Store: put the secret in the deployment platform’s secret store or a local environment variable excluded from version control.
  3. Rotate: create a replacement, deploy it, confirm traffic uses it, then revoke the old key.
  4. Disable: temporarily stop a key while preserving its record and usage history.
  5. Revoke: permanently invalidate a key that is retired or suspected to be exposed.
Key lists show safe identifiers such as name, prefix, scopes, state, and recent use. They never return the complete secret after creation.

​
Client-side applications

Do not call Qoory directly from untrusted browser or mobile code with a private key. Put the key behind your own server and expose only the operations and data your application needs. Allowed browser origins for MCP do not turn a bearer key into a public credential.