Creating an API Key

API keys let you authenticate requests to the ProLinksQR API without a user login. Each key belongs to your account and carries a set of scopes that determine which endpoints it can call.

Create a key in the dashboard

1. Sign in to your ProLinksQR dashboard.
2. Open the API Keys page (top-right Developers menu → or go directly to /apikeys).
3. Click Create API Key.
4. Give the key a descriptive name (e.g. Zapier integration, CI bot).
5. Select the scopes the key needs (see below). Grant the minimum required.
6. Choose an expiration — 7 days, 30 days, 90 days, 1 year, or Never (default). A key past its expiration is automatically deactivated (see Managing keys).
7. Click Create.

:::warning Copy your key now The full key (it starts with key-) is shown only once, immediately after creation. Copy it and store it somewhere safe — a password manager or your app's secret store. After you close the dialog, only a masked version and a short prefix are visible, and you cannot recover the full key. If you lose it, delete the key and create a new one. :::

Choosing scopes

Scopes follow a resource.action pattern. Grant only what your integration needs:

Scope	Grants
all	Full access to every API-key endpoint.
links.read	List and read links.
links.create	Create and duplicate links.
links.update	Update links and patch QR options.
links.delete	Archive/delete links.
links.pause / links.resume	Pause / resume links.
folders.read / folders.create / folders.update / folders.delete	Manage folders.
templates.read / templates.create / templates.update / templates.delete	Manage QR templates.
bulk.create	Bulk-generate links.
cafe.read / cafe.create / cafe.update / cafe.delete	Manage Cafe (digital menu) resources.

A key with no matching scope for an endpoint receives a 403 Forbidden.

Managing keys

From the API Keys page you can also:

• View a key's name, short prefix, scopes, active state, created date, and expiration date (if one is set).
• Update a key's name, scopes, active state, or expiration.
• Deactivate / delete a key. A deactivated or deleted key immediately stops authenticating — requests using it return 401 Unauthorized.
• Let a key expire. Unlike manual deactivation, expiration is not instant: a background job checks for expired keys roughly every 15 minutes and deactivates them at that point, so a key may keep working for a short time after its expiration timestamp passes.

Next steps

Head to Authentication to learn how to send your key with each request, then jump into the API Reference.