API Authentication

Every API request must be authenticated with an API key created in the Developer Dashboard.

How keys work

• Keys have the format qrc_ followed by 64 hexadecimal characters.
• The full key is shown once, at creation time. We store only a SHA-256 hash, so it can never be recovered later — if you lose it, revoke it and create a new one.
• You can create multiple keys (for example, one per environment) and revoke any of them independently.
• Keys are created and revoked in the dashboard only; there is no API endpoint for key management.

Sending the key

Use the Authorization header with the Bearer scheme:

POST /api/v1/qr HTTP/1.1
Host: www.qrcodegenius.com
Authorization: Bearer YOUR_API_KEY
Content-Type: application/json

The one exception is GET /render, which accepts the key as a ?key= query parameter so it can be used directly as an image source.

Keeping keys safe

• Store keys in environment variables (for example a .env file), never in source code or public repositories.
• Call the API from your backend, not from browsers or mobile apps.
• If a key is compromised, revoke it immediately in the Developer Dashboard — revocation takes effect right away.

Authentication errors

• 401 Unauthorized — the Authorization header is missing or malformed, or the key is invalid or revoked.
• 403 Forbidden — the key is valid but your plan does not include the feature (for example, bulk generation requires Pro).
• 429 Too Many Requests — your monthly quota and credits are exhausted. See Errors and rate limits.