SECURE AN API INTEGRATION.

Steps

1. 1. Get a key

   Workspace admins issue keys in the app at /app/api-keys. Start with a sandbox key: it is bound to a showroom workspace and can never touch live data. Keep the secret server-side.

   export QN_API_KEY="qn_sandbox_…"
   curl "$QN_BASE/me" -H "Authorization: Bearer $QN_API_KEY"

2. 2. Create one identity per integration

   Do not share one key across a warehouse job, a conversion service, and a reporting tool. Separate credentials make ownership, usage, rotation, and revocation clear.

3. 3. Grant only the required scopes

   A read-only warehouse sync does not need events:write or actuals:write. Begin with the guide's listed scopes and add a scope only when a real request requires it.

4. 4. Keep the secret server-side

   Store API keys and OAuth client secrets in your server secret store. Browser collection uses a PixelBridge pixel code instead and must not receive a workspace API key.

5. 5. Rotate and review

   Create the replacement credential, move the integration, confirm successful requests, then revoke the old credential. Review request and webhook delivery logs after the change.