Authentication
Select the credential required by each current ZipQuantum endpoint.
Individual scoped REST key
For a new agent or service, create an individual, expiring Bearer credential under API access and grant only the required short_links:* scopes. It can be revoked without disrupting the account or another agent. X-Api-Key remains available for legacy integrations only.
curl 'https://a.zq.tn/api/v1/custom-domains' \ --header 'Accept: application/json' \ --header 'X-Api-Key: YOUR_API_KEY'
MCP OAuth
Do not paste an API key into an MCP client. It uses OAuth 2.1 with PKCE, sends the user through ZipQuantum login and explicit initial consent, and receives a token restricted to https://a.zq.tn/mcp and the selected scopes. After consent the agent can work autonomously inside those scopes. Users can suspend or revoke it from AI assistant connections; AI credentials cannot permanently delete resources.
Internal secret
X-Api-Secret protects administrative /v1 operations. It must remain on trusted servers and is not part of the customer API contract.
Public endpoints
Availability checks, public catalogue, anonymous creation, and public platform settings do not require a user key, but still validate input and may be rate- or feature-limited.
Rotation and revocation
Use one credential per person, service or agent. Revoke only the compromised credential when it is no longer trusted. Never include credentials in URLs, logs, screenshots, prompts, browser JavaScript, or mobile bundles.