Authentication

APIQuick uses two auth paths: dashboard Bearer sessions for provider/account management and APIQuick API keys for runtime proxy invocation. End users never call provider backends directly; they call the APIQuick proxy URL with an invocation key.

Auth Models

Auth	Header	Use case
Dashboard session	`Authorization: Bearer ...`	Provider onboarding, imports, collection updates, account pages, and key management.
APIQuick API key	`X-APIQUICK-API-KEY: aqk_...`	Runtime calls to `/v1/proxy/{collectionSlug}/{endpointKey}`.

API Keys

Create keys from the API Keys page. Keep keys server-side whenever possible. Playground-generated keys are intended for testing APIQuick proxy endpoints from the browser.

curl -X GET "https://api.quickpod.org/apiquick/v1/proxy/breach-api-7/get-breach-risk-by-domain?domain=example.com"   -H "X-APIQUICK-API-KEY: aqk_..."

Warning

Do not expose production API keys in public repositories. Browser playground keys should be scoped and rotated regularly.

Scopes

Scope	Description
`proxy:invoke`	Required to invoke metered APIQuick proxy endpoints.
`apis:read`	Read API collection metadata where key-based reads are supported.
`usage:read`	Read usage and credit event data for dashboards and tooling.
`keys:write`	Create or manage APIQuick API keys through key-management flows.

Rate Limiting

Runtime proxy calls are rate-limited per API key when an endpoint has rpm_limit configured. Public endpoint details include rpm_limit when a limit is set; otherwise the endpoint uses the platform default behavior.

{
  "error": "rate_limit_exceeded"
}

Credits

Every public endpoint has a positive credit_cost. The proxy checks the caller's wallet before contacting the hidden upstream backend. If the caller cannot afford the endpoint, APIQuick returns 402 insufficient_credits and does not call the provider backend.

{
  "error": "insufficient_credits"
}

When a proxy call is allowed, APIQuick reserves the cost, forwards the request, logs usage, and credits the provider wallet after platform fees. If the upstream transport fails before a response is received, the reserved charge is refunded.

Security Best Practices

Use separate keys for development, playground testing, and production.
Give invocation keys only the scopes they need, usually proxy:invoke.
Rotate keys regularly and revoke keys you no longer use.
Keep provider upstream URLs private; publish only APIQuick proxy URLs to consumers.
Monitor Usage & Credits for unusual traffic, credit spend, and rate-limit events.