Authentication
Select the credential required by each current ZipQuantum endpoint.
User API key
Send X-Api-Key to authenticated link and domain endpoints. The key belongs to one account and inherits that account’s plan and ownership.
curl 'https://a.zq.tn/api/v1/custom-domains' \ --header 'Accept: application/json' \ --header 'X-Api-Key: YOUR_API_KEY'
MCP OAuth
Do not paste an API key into an MCP client. It uses OAuth 2.1 with PKCE, sends the user through ZipQuantum login and consent, and receives a token restricted to https://a.zq.tn/mcp and the mcp scope. Users can revoke it from AI assistant connections.
Internal secret
X-Api-Secret protects administrative /v1 operations. It must remain on trusted servers and is not part of the customer API contract.
Public endpoints
Availability checks, public catalogue, anonymous creation, and public platform settings do not require a user key, but still validate input and may be rate- or feature-limited.
Rotation and revocation
Regenerate a user API key only when necessary. Revoke an MCP connection when it is no longer trusted. Never include credentials in URLs, logs, screenshots, prompts, browser JavaScript, or mobile bundles.