Authentication

The API authenticates requests with an API key sent as a Bearer token. Keys belong to your organization and carry fine-grained scopes for zones and records.

Bearer keys

Send your key in the Authorization header on every request:

Authorization header

Authorization: Bearer qfx_1a2b3c4d_kJ8x...

A complete request looks like this:

cURL

curl 'https://api.qflaryx.com/v1/orgs/$ORG_ID/zones' \
  -H 'Authorization: Bearer $QFLARYX_KEY'

Keep secrets server-side

An API key grants access to your organization's DNS — a leaked key can redirect your domains. Use it only from your backend, never from browser or mobile clients. If a key leaks, revoke it immediately from the dashboard.

Key format

Every key starts with the qfx_ prefix followed by an 8-character public identifier and the secret part: qfx_1a2b3c4d_<secret>. Only the prefix is stored in listings — the API keeps a hash of the full key, never the key itself.

Creating a key

Keys are created from the dashboard, under API Keys (/painel/tokens). Creating and revoking keys requires the owner or admin role in the organization. Pick the scopes the key needs and copy the secret.

Shown once

The full key secret is displayed only once, at creation. We store just a hash — if you lose it, create a new key and revoke the old one.

The API key object

Field	Type	Description
`id`	integer	Unique identifier of the key.
`prefix`	string	Public, non-secret prefix (qfx_ + 8 hex chars) used to identify the key in listings.
`scopes`	string[] \| null	Scopes granted to the key. Defaults to all four scopes.
`last_used_at`	datetime \| null	When the key last authenticated a request.
`revoked_at`	datetime \| null	When the key was revoked; null while active.
`created_at`	datetime	Creation timestamp (UTC).
`secret`	string	The full key. Present only in the creation response — never again.

Scopes

A key only reaches what its scopes allow. Grant the least you need — a key that only manages records doesn't need zone:write. By default a new key gets all four scopes.

Scope	Type	Description
`zone:read`	scope	List zones, read zone details, setup and delegation status.
`zone:write`	scope	Create, import, check and delete zones; manage DNSSEC.
`record:read`	scope	List the records of a zone.
`record:write`	scope	Create, update and delete records.

Revoking a key

Revoke a key at any time from the dashboard. Revocation is immediate — the key stops authenticating on the next request — and permanent: revoked keys cannot be re-enabled, so create a new one instead.

Best practices

One key per integration or environment — rotation stays painless and the blast radius of a leak stays small.
Store keys in a secret manager or environment variables, never in source control.
Prefer narrow scopes: record:write alone is enough for dynamic-DNS style updates.
Watch last_used_at in the dashboard to spot stale keys and retire them.

Dashboard sessions

The dashboard itself signs in with its own user session (e-mail and password) — that flow is not part of the integration surface. As an integrator, API keys are all you need.

Base URL

All endpoints live under a single versioned prefix, and every resource path is scoped to your organization (/orgs/{org_id}/…):

Base URL

https://api.qflaryx.com/v1

Previous Kubernetes Next Errors