Authentication

Each call carries the API key of the organization in the Authorization header:

Authorization: Bearer qx_sua_chave

API key

The key starts with qx_.
The key belongs to one organization. A call reaches only the data of that organization.
The QX admin creates the key and delivers the key text through a single-use link. The text appears only once.
Keep the key in the secrets manager of your server.
Never send the key by email, and never write the key to a log.
If the key leaks, ask QX to revoke the key. The next call with the revoked key gets 401.

The API checks the key and the organization before each call.

Status	`code`	When
401	`unauthorized`	The key is missing, does not exist or is revoked.
402	`subscription_blocked`	The subscription of the organization is blocked.
403	`organization_archived`	The organization is archived.
403	`plan_required`	The free plan does not include the API.

A paid write is a call that starts a paid service, such as a CNPJ lookup or the reading of a document. These are the paid writes:

Limit	Value	`code` of the `429`
Calls from one key	300 per minute	`rate_limited`
Paid writes from one key	30 per minute	`rate_limited`
Paid writes from one key	1,000 per day	`daily_limit_reached`
Invalid keys from one IP address	60 per minute	`too_many_invalid_keys`

The day of the daily limit follows the time zone of the organization. The limit resets at midnight.
Each 429 response has the Retry-After header, with the seconds to wait.
QX adjusts the daily limit of a key when the organization asks.