DocsGetting StartedAuthentication
Authentication
Every request is authenticated with a Bearer API key.
The Authorization header
Pass your key in the Authorization header (or X-API-Key) on every request. Keys never go in query strings - they would end up in logs.
curl -H "Authorization: Bearer qw_live_YOUR_KEY" \
"https://quantwheel.com/api/v1/wheels"
# X-API-Key also works:
curl -H "X-API-Key: qw_live_YOUR_KEY" \
"https://quantwheel.com/api/v1/wheels"Key format
| Prefix | Notes |
|---|---|
| qw_live_ | One active key per account, created under Dashboard → API & MCP. Requires an active Quant subscription. Regenerating revokes the previous key. |
The same key works for the REST API, the MCP server and the desktop bridge. Sandbox keys with sample data are on the roadmap.
Auth errors
401 Unauthorized
{
"error": "Invalid or missing API key. Create one under Dashboard → API & MCP.",
"code": "invalid_api_key",
"contact": "hello@quantwheel.com"
}| Status | Code | Meaning |
|---|---|---|
| 401 | invalid_api_key | Key missing, malformed or revoked. |
| 403 | plan_restricted | Subscription inactive, or the endpoint needs a higher tier (flow endpoints require Pro). |
| 402 | insufficient_credits | AI endpoints only - the monthly grant resets next calendar month. |
| 429 | rate_limited | Too many requests - see Rate Limits. |
Best practices
Keep keys server-side
Never ship a
qw_live_ key in browser or mobile code. Proxy through your backend and regenerate the key from the dashboard on any suspicion of a leak. Usage is tracked per caller, so shared keys are detected.