# ZipQuantum Documentation

> ZipQuantum creates and resolves Smart Links on managed `*.zq.tn` hosts and verified custom domains. This documentation reflects the current production-oriented Laravel and WordPress implementation.

## Start here
- [Getting Started overview](https://zq.tn/docs/getting-started/)
- [Documentation overview](https://zq.tn/docs/overview/)
- [Create your first Smart Link](https://zq.tn/docs/create-first-smart-link/)
- [One-time app setup](https://zq.tn/docs/one-time-app-setup/)
- [Test your first link](https://zq.tn/docs/test-first-link/)

## Platform setup
- [Official mobile examples repository](https://github.com/ProxiwebLabs/zipquantum-mobile-examples)
- [Platform setup overview](https://zq.tn/docs/platform-setup/)
- [iOS Universal Links](https://zq.tn/docs/ios-universal-links/)
- [Android App Links](https://zq.tn/docs/android-app-links/)
- [Flutter](https://zq.tn/docs/flutter/)
- [React Native](https://zq.tn/docs/react-native/)

## Core concepts
- [Core concepts overview](https://zq.tn/docs/core-concepts/)
- [Smart Links](https://zq.tn/docs/smart-links/)
- [Deferred deep linking](https://zq.tn/docs/deferred-deep-linking/)
- [Routing and resolution](https://zq.tn/docs/routing-resolution/)
- [Fallbacks](https://zq.tn/docs/fallbacks/)
- [Link parameters](https://zq.tn/docs/link-parameters/)
- [QR Smart Codes](https://zq.tn/docs/qr-smart-codes/)

## Guides
- [Guides overview](https://zq.tn/docs/guides/)
- [Configure store fallbacks](https://zq.tn/docs/configure-store-fallbacks/)
- [Social preview](https://zq.tn/docs/social-preview/)
- [Campaign and UTM parameters](https://zq.tn/docs/campaign-utm-parameters/)
- [Expiration and click limits](https://zq.tn/docs/expiration-click-limits/)
- [Custom domains](https://zq.tn/docs/custom-domains/)
- [Firebase Dynamic Links migration](https://zq.tn/docs/firebase-dynamic-links-migration/)

## API reference
- [API Reference overview](https://zq.tn/docs/api-reference/)
- [API overview](https://zq.tn/docs/api-overview/)
- [Authentication](https://zq.tn/docs/authentication/)
- [Create link](https://zq.tn/docs/create-link/)
- [Manage links](https://zq.tn/docs/manage-links/)
- [Parameters](https://zq.tn/docs/parameters/)
- [Responses, errors, and limits](https://zq.tn/docs/responses-errors-limits/)
- [OpenAPI description](https://zq.tn/docs/openapi.yaml)

## API and AI integrations
- Authenticated link management supports list, create, read, update, delete, branded QR generation, account usage, plan capabilities, and analytics under `/api/v1`.
- These endpoints require a user API key and the plan capability `full_api_access`; analytics additionally requires `basic_analytics` or `analytics_dashboard`.
- The remote Model Context Protocol endpoint is `/mcp`. It uses Streamable HTTP and OAuth 2.1 authorization code flow with PKCE.
- MCP access requires both `full_api_access` and `mcp_access` in the user's current plan.
- MCP tools manage only resources owned by the consenting account. Deletion requires explicit confirmation.
- MCP clients discover OAuth metadata, send the user through ZipQuantum login and consent, and receive resource-bound access tokens; users do not copy an API key into the client.

## Machine-use rules
- The ZipQuantum SaaS does not require a ZipQuantum mobile app. Mobile integrations are optional client-side examples and support material.
- Treat URLs and link parameters as public data; never place secrets or private user data in them.
- Never embed a ZipQuantum user API key or internal API secret in public JavaScript or a distributed mobile binary.
- Installed apps open through iOS Universal Links or Android App Links. Deferred recovery is deterministic: Android uses Play Install Referrer and iOS uses a short-lived, signed, user-initiated handoff.
- ZipQuantum requires no proprietary iOS, Android, Flutter, or React Native SDK. A one-time platform integration is still required for in-app routing and post-install recovery.
- Deferred recovery uses opaque, scoped, replay-resistant tokens and never uses fingerprinting or probabilistic device matching.
- Optional device context is separate from routing and must be stored only with explicit consent.
- Use only verified custom domains owned by the authenticated account.
- Never place API keys or OAuth tokens in prompts, public JavaScript, mobile applications, URLs, link parameters, logs, or source control.