Skip to main content
API keys let you access the Quikly REST API programmatically. Use them with n8n, custom scripts, CI/CD pipelines, or any HTTP client. The same kind of key authenticates the Discovery Copilot browser extension — see Discovery Copilot.

​
Create an API key

1

Open API key settings

Go to Settings → API Keys in the Quikly app.
2

Click Create API Key

Enter a descriptive name (e.g., “n8n automation” or “Cursor MCP”) and select the scopes you need.
3

Copy the key

The full key is shown only once. Copy it and store it somewhere safe — you cannot retrieve it later.

​
Scopes

Each API key has one or more scopes that control what it can do:
Follow the principle of least privilege. If an integration only needs to read data, create a key with read scope only.

​
Authenticate requests

Include your API key in the X-API-Key header on every request:

​
Rate limits and quota

API calls are rate-limited per minute and capped monthly depending on your plan: When you exceed your monthly quota, the API returns 402 Payment Required. When you exceed your per-minute limit, the API returns 429 Too Many Requests and includes a Retry-After header.

​
Per end-user limits (X-External-User-Id)

When X-External-User-Id is present (after normalization), the API applies additional limits on top of your account totals:
  • Per end-user per minute: default 12 requests/minute per distinct X-External-User-Id (configurable server-side).
  • Per end-user per UTC calendar month: default min(your plan's monthly API quota, 250) calls for that same X-External-User-Id.
If the end-user slice is exceeded, responses use 402 with error: external_user_quota_exceeded or 429 with error: external_user_rate_limit_exceeded. These limits use in-memory counters (they reset on server restart and on UTC month rollover for the monthly slice). They mitigate one downstream tenant burning an entire API key’s pool.

​
Per agent/workflow limits (X-Agent-Id)

When X-Agent-Id is present (after normalization), the same pattern applies independently of X-External-User-Id:
  • Per agent per minute: default 12 requests/minute (configurable server-side).
  • Per agent per UTC calendar month: default min(your plan's monthly API quota, 250) calls for that X-Agent-Id.
Errors: 402 with error: agent_id_quota_exceeded or 429 with error: agent_id_rate_limit_exceeded. If both X-External-User-Id and X-Agent-Id are set, all three limits apply: account-wide, per end-user, and per agent.

​
Integration traceability headers

For external integrations, send these headers on every request: Requests without these headers can be rejected with 400 Bad Request.
Self-serve API keys are for your own direct integrations. Multi-tenant resale or proxying Quikly as a hidden backend for third-party customers is restricted and can trigger key suspension. See Self-serve vs Partner tier for the right tier for your use case.
Check your current usage with:
You can also pre-check before an operation:

​
Response headers

Every response from the public API includes these attribution headers. Clients can safely ignore them, but they are useful for logging, debugging, and proving that a given piece of data came from Quikly:
Removing or masking these headers before relaying Quikly-generated content to end-users is a breach of the Terms of Service §5.3.2 on self-serve plans. Partner integrations can negotiate attribution rules in their agreement.

​
Manage existing keys

In Settings → API Keys, you can:
  • Rename a key to keep your list organized
  • Deactivate a key temporarily without deleting it
  • Revoke a key permanently — revoked keys cannot be reactivated

​
Security best practices

Never commit API keys to version control or expose them in client-side code.
  • Use environment variables to store keys in your deployment environment.
  • Rotate keys periodically — create a new key, update your integrations, then revoke the old one.
  • Use the narrowest scope that your integration requires.
  • Set expiration when creating keys for temporary integrations. You can specify expires_in_days during creation.
  • Monitor usage by checking the usage endpoint or the API Keys page in the dashboard. Each key shows its last-used timestamp.
  • Revoke immediately if a key is compromised.

​
Key format

Quikly API keys follow the format qk_ followed by a random string. When you view keys in the dashboard, only the prefix (e.g., qk_abc1...) is visible — the full key is only shown at creation time.