Quickstart: make your first API request

API keys are created in the dashboard. There is no API call that creates one.

1. Sign in and open Settings → Developer API. In the dashboard’s left sidebar choose Settings, then Developer API in the settings menu.
2. Click New API key.
3. Give it a name that says what it is for, such as “HR onboarding sync”. You will be glad of it when you have three keys.
4. Choose its scopes. A scope is a permission. For this quickstart any scope will do, because the first request needs none. For the guides that follow, select cards:read, cards:write, templates:read, qr:read, qr:write and analytics:read.
5. Choose whether the key expires (never, 30 days, 90 days or one year), and create it.
6. Copy the key now. It is shown once. QRBold stores only a hash of it, so nobody, including support, can show it to you again.

The page only appears to people who may manage API keys on the account. If you were invited to someone else’s account and cannot see it, ask the account owner to create the key for you.

Every request carries the key in an HTTP header. Nothing else: no cookies, no signing, no token exchange.

Authorization: Bearer YOUR_API_KEY

Replace YOUR_API_KEY with the whole key, including the qrb_live_ prefix. If your tool can only set a custom header name and value, X-API-Key: YOUR_API_KEY works the same way.

Do not paste the key into your code. Put it in an environment variable and let your code read it from there. Every example in these docs reads it from QRBOLD_API_KEY:

export QRBOLD_API_KEY="qrb_live_your_key_here"

$env:QRBOLD_API_KEY = "qrb_live_your_key_here"

A request with a missing or wrong key answers 401 with the code invalid_api_key. To stop a key working, revoke it on the same dashboard page; it fails on the very next request. The authentication guide covers scopes, rotation and revoking in full.

Every endpoint starts with the same base URL:

https://api.qrbold.com/api/public/v1

QRBold has several addresses, and they do different jobs. Mixing them up is the most common first mistake.

You call the first one. Your users only ever see the last two. An API endpoint is never what a QR code points at. Core concepts and URLs explains each in detail.

GET /me tells you which key you are using and what it may do. It needs no scope and changes nothing, so it is safe to run as often as you like.

curl "https://api.qrbold.com/api/public/v1/me" \
  -H "Authorization: Bearer $QRBOLD_API_KEY"

Running the samples

• cURL: paste it into a terminal where QRBOLD_API_KEY is set. On Windows, use PowerShell’s curl.exe and write $env:QRBOLD_API_KEY in place of $QRBOLD_API_KEY.
• JavaScript: save it as me.mjs and run node me.mjs. It needs Node.js 20 or later and no packages. The .mjs extension lets the file use await at the top level.
• Python: run pip install requests once, save the sample as me.py and run python me.py.

{
  "object": "api_key_context",
  "key": {
    "id": "cmf3jz8n10000",
    "name": "HR onboarding sync"
  },
  "scopes": [
    {
      "scope": "cards:read",
      "description": "List and retrieve digital business cards"
    },
    {
      "scope": "cards:write",
      "description": "Create, update and delete digital business cards"
    }
  ],
  "account": {
    "id": "cmf2x9u4w0000",
    "email": "you@example.com",
    "plan": "pro"
  },
  "rateLimit": {
    "requestsPerMinute": 120
  }
}

rateLimit.requestsPerMinute is how many requests this key may make each minute. scopes lists what it may do. If a scope you need is missing, create a new key: scopes cannot be added to an existing one.

If you did not get a 200, find your status below.

An error always tells you what went wrong in the same shape:

{
  "error": {
    "type": "authentication_error",
    "code": "invalid_api_key",
    "message": "Invalid API key"
  }
}

Every code, with its cause and whether to retry, is in the error reference.

Next

Your key works. Now create your first digital business card.