Skip to content
Developers
Esc
↑↓navigate↵open⌘Jpreview
On this page

Authentication

Create, use, protect and revoke Qaf API keys. Keys belong to your Qaf account and are created in qaf.ai Settings › API keys.

The Qaf API authenticates every request with an API key that belongs to your Qaf account. Send it as a bearer token:

Authorization: Bearer qaf_sk_…

The MCP server doesn’t use API keys: AI apps sign in with your Qaf account instead.

Create a key

  1. Open Settings › API keys on qaf.ai. Sign in first if asked; a guest session can’t create keys.
  2. Select Create key and give the key a name that says where you’ll use it, such as “Production server”.
  3. Copy the key and store it somewhere safe, such as your server’s secret store. The key is shown only once; Qaf keeps only a hash of it.

Keys start with qaf_sk_. The list in Settings › API keys shows the start of each key, when it was created and when it was last used, so you can tell keys apart without seeing them in full.

An account can have up to 10 keys at a time, and can create up to 20 keys an hour.

Keep keys secret

A key gives full access to the API under your account, so treat it like a password.

  • Call the API from your server. Never put a key in a web page, a mobile app or a desktop app, where anyone can read it.
  • Keep keys out of source control. Read them from an environment variable or a secret store.
  • Use one key per app or environment. You can then revoke one without stopping the others.

All of an account’s keys share one rate limit, so a second key doesn’t add capacity.

Revoke a key

In Settings › API keys, select the delete icon next to the key, then Revoke. Apps using it stop working right away, and revoking can’t be undone. Create a new key to replace it.

If a key may have leaked, revoke it first, then create a new one.

Keys and your account

  • Requesting account deletion revokes all your keys, so requests with them get a 401.
  • A suspended account’s keys are refused with 403 while the suspension lasts, and work again when it ends.
  • Keys made for the partner API (qaf_live_…) don’t work with v1. See Migrate from the partner API.

Try it in the reference

The API reference has a Try it panel. It sends your key from your browser straight to api.qaf.ai; the docs site never receives it. If you select Remember on this device, the key is stored in this browser. Use a separate key for testing, and revoke it when you’re done.

Errors

Status Message Cause
401 Send an API key in the Authorization header, as Bearer <key>. The Authorization header is missing or isn’t a bearer token.
401 Invalid API key. The bearer token isn’t a Qaf API key, or names a key that doesn’t exist or was revoked.
401 This key can't call the Qaf API. Create a key in qaf.ai Settings › API keys. The key was made for the partner API.
403 This Qaf account can't use the API. The key’s account is suspended.
429 Too many requests. Try again later. The key doesn’t exist or was revoked, and your network address has sent too many such keys. data.reason is invalid_keys. Fix the key rather than retrying.

A 401 has a WWW-Authenticate header: Bearer realm="api.qaf.ai" when the request sent no key, and Bearer realm="api.qaf.ai", error="invalid_token" when it sent a key that can’t be used. See Errors for the error format.