Developer API

Integrate QR Helix into another application. Access is not self-serve: submit an application and wait for Super Admin approval. An API key is generated only after that review.

Request API accessSign in

Authentication

Send your approved key on every request:

X-API-Key: qh_live_your_api_key_here
# or
Authorization: Bearer qh_live_your_api_key_here

Endpoints

Base path: /api/v1

  • GET /qr-codes — list QR codes, including PNG image and short URL
  • GET /qr-codes/{id} — get one QR code
  • POST /qr-codes — create a QR code
  • PATCH /qr-codes/{id} — update title, URL, description, or active status
  • DELETE /qr-codes/{id} — delete a QR code
  • GET /qr-codes/{id}/analytics — analytics for one QR code
  • GET /analytics — analytics across all of your QR codes

Security

  • Keys are hashed at rest and shown in plaintext only once.
  • Optional IP allowlists are enforced on every call.
  • Requests are rate limited. Failed auth attempts are lockout-protected.
  • A leaked key can be revoked from Profile. Super Admins can revoke any key.