Authentication

Qorlivo API requests authenticate with secret API keys. API keys identify the Qorlivo account and plan used for the request.

Create an API key

1. Open the Qorlivo dashboard.
2. Go to Settings.
3. Open Developers.
4. Choose Create API key.
5. Give the key a clear name, such as Production CMS or Campaign automation.
6. Copy the key immediately and store it securely.

For security, Qorlivo only shows the full key at creation time. If you lose it, revoke the old key and create a new one.

Send the key

Use the Authorization header on every request.

Authorization: Bearer qrlv_live_your_api_key

Example:

curl https://www.qorlivo.com/api/v1/links \
  -H "Authorization: Bearer $QORLIVO_API_KEY"

Requests without a valid Bearer key return 401.

Key format

Live API keys begin with:

qrlv_live_

This prefix helps you identify Qorlivo keys in logs and secret tools. The prefix is not a permission boundary; treat the entire key as secret.

Plan-based access

Your plan determines what authenticated API requests can do.

If your key is valid but your plan does not include an action, the API returns 403.

Rate limits

API rate limits vary by plan.

When you exceed the limit, Qorlivo returns 429 and retry headers. See Errors & Rate Limits.

Secret handling

Do:

• Store keys in server-side environment variables or a secret manager.
• Use one key per app or automation.
• Rotate keys when a teammate leaves or a key may have been exposed.
• Revoke unused keys.
• Name keys by owner and purpose.

Do not:

• Put keys in public browser code.
• Ship keys in mobile apps.
• Paste keys into public issue trackers or chat rooms.
• Share one key across unrelated systems.
• Log full keys.

Rotation

To rotate a key with minimal interruption:

1. Create a new key.
2. Add it to your app's secret configuration.
3. Deploy or restart your app so it uses the new key.
4. Confirm requests succeed.
5. Revoke the old key.

If a key is exposed, revoke it first, then create and roll out a replacement.