User API keys

If you'd rather authenticate with your own key — issued from /dashboard/keys — instead of the RapidAPI marketplace proxy secret, this page is for you. Same engine, different door.

Marketplace clients should keep using X-RapidAPI-Proxy-Secret against api.qr-branding.com. The consumer-keys gateway lives on qr-branding.com/api/v1/* and never disturbs the marketplace channel.

Base URL

https://qr-branding.com/api/v1

Authentication

Send your key on every request:

X-API-Key: qrb_…

The key is verified at the edge (CF Pages) against the hash in our database — the engine itself never sees your plaintext key.

If the key is missing, malformed, or revoked you get:

{ "success": false, "error": "Key not recognised, revoked, or malformed.", "code": "invalid_api_key" }

(401 status code.)

Studio plan required

The API is a Studio feature. Every request — not only the AI ones — needs an active Studio pack (bought less than 12 months ago and not refunded). With a valid key but no Studio, the gateway answers 402 with links to this page and to pricing:

{ "success": false, "error": "The QR Branding API is included with Studio. Buy a Studio pack at https://qr-branding.com/pricing to use your key.", "code": "studio_required", "docs": "https://qr-branding.com/docs/api/public-keys", "pricing": "https://qr-branding.com/pricing" }

AI generations on our LLM keys (POST /api/v1/qr/ai/generate/server) also spend one AI credit from your Studio pack; once they run out you get 402 out_of_api_credits with the same links. Every other call spends no credits.

Available endpoints

The gateway forwards every path under /api/v1/* to the engine. So:

Bodies, response shapes and error codes are identical to the engine endpoints — keep your docs page bookmarks.

Quick test

curl -X POST https://qr-branding.com/api/v1/qr/generate \
  -H "X-API-Key: qrb_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{ "content": "https://yourbrand.com", "primaryColor": "#dcc28a", "backgroundColor": "#0a0b0e", "eccLevel": "H" }' \
  --output qr.png --silent --write-out "%{http_code}\n"

If you get a 200 and a qr.png on disk, you're done.

Limits

User keys get the consumer channel's per-customer limits:

Hit a limit and you get a 429 with a Retry-After header. Details and global caps are in the API overview.

Multipart uploads

The gateway accepts JSON only. For binary logo / background uploads use base64 fields (logoBase64, backgroundImageBase64) instead of multipart/form-data. We may add native multipart support in v2.

Rotation

Generate a fresh key, deploy it, then revoke the old one. The plaintext is only shown once — store it in your secrets manager.

# in your CI / secrets tool
QR_BRANDING_KEY=qrb_new_key_here

When the old key gets a 401 invalid_api_key from the gateway it means your fleet has fully migrated and you can confirm the rotation worked.