Authentication
qbill has two separate authentication mechanisms. Which one you use depends on whether a person or a machine is making the request.
Two mechanisms
| Mechanism | Used by | Sent as |
|---|---|---|
| API key | Your ERP, scripts, and anything server-to-server | x-api-key |
| Session token (JWT) | The qbill dashboard in a browser | Authorization: Bearer … |
Generating an API key
In the dashboard, go to Developer Resources → API Keys and generate a key. Only organisation owners and admins can do this.
The key is shown once
qbill stores only a SHA-256 hash of your key, never the key itself. That means it can't be shown to you again and can't be recovered by support. Store it in your secret manager immediately. If you lose it, revoke it and generate a new one.
What a key can and cannot do
- A key is scoped to one organisation. It can never read or write another organisation's data.
- Revoking a key takes effect immediately — in-flight requests using it will start returning 401.
- Keys do not expire on their own. Rotate them on your own schedule by generating a replacement, switching over, then revoking the old one.
Failures
| Status | Meaning |
|---|---|
| 401 | Missing, invalid or revoked key |
| 403 | Valid key, but the action isn't permitted — for example the organisation isn't yet verified |
| 429 | Rate limit exceeded — 60 requests per 60 seconds |