Manage your API keys

An API key lets an external tool (CRM, Zapier or Make automation, internal script, AI agent) create, read, update, archive, reactivate or delete the QR codes on your account and read their statistics and the remaining creation quota, without going through the dashboard. How the API works technically (addresses, formats, error codes) is described in the API documentation. This page explains how to manage your keys.

API access is included in the Pro and Entreprise plans. The Free plan gives no access to the API and no key.

Where to manage your keys

Keys are managed on the API keys screen, which you reach from the API keys card on the Subscription screen (Manage my API keys button).

• The API keys screen is reserved for members who have the Manager of API keys permission (or Administrator).
• The API keys card on the Subscription screen only appears for members who have both Manager of the subscription and Manager of API keys (or Administrator).

Create a key

1. On the API keys screen, in the Create an API key form, enter a Key name that will help you recognise it, for example "Zapier integration".
2. Under Key rights, choose a preset or Custom (see below).
3. Click Create key.
4. The Copy your API key now screen shows the full key, which starts with qrs_live_. Click Copy and store it in a safe place, for example in your tool's password or secrets manager. Tick I have copied my key to a safe place., then click Done.

The full key is only shown once. We do not store it in plain text and cannot send it to you again. Afterwards, the screen only shows its last 4 characters (qrs_live_••••abcd). If you lose it, rotate it (see "Rotate a key") or create a new one.

Creating a key never counts towards your monthly quota: the quota only applies to QR codes created via the API.

If your plan's maximum number of keys is reached, the creation form no longer appears. Note: when you create a key, frozen keys count towards this limit (see "Frozen keys"). Revoke the keys you no longer need first.

Use the key

Your tool sends the key in the header of each request: Authorization: Bearer qrs_live_…. The API documentation describes the available operations and the right each one requires.

On the API keys screen, each key shows its creation date, the date of its last rotation and the date it was last used (or Never used): handy for spotting a key that no tool uses any more. This date is updated at most once a minute. A call refused for a missing right or for exceeding the rate limit does not change it.

Dates on the API keys screen are shown in Swiss time. The API, however, gives all its dates in UTC, in ISO 8601 format: the final Z means UTC. For example, 2026-10-17T22:12:00.000Z corresponds to 18 October 2026 at 00:12 in Switzerland. It is up to your tool to convert these dates to the time zone it needs.

Choose a key's rights

A key can only do what its rights allow. Give it only the rights the tool needs: a key that only reads can neither create nor delete a QR code, even if it is pasted in the wrong place by mistake.

With Custom, you tick the rights you want yourself, out of the 5, at least one.

You can change the rights of an existing key at any time, then click Save rights. The change applies immediately, without changing the key: the tool that uses it has nothing to reconfigure, it can simply do more or fewer things.

A call that requests an operation the key's rights do not allow is refused (403 forbidden error).

Two operations require a less obvious right:

• archiving or reactivating a QR code requires Update QR codes;
• reading the creation quota (creations of the month, pack balance) requires Create QR codes. The Read / Reporting and AI assistant agent presets therefore cannot read this balance.

Creation quotas and packs

Only creating a QR code via the API counts: reading, updating, archiving, reactivating or deleting a QR code, downloading its image or reading its statistics does not. QR codes created from the dashboard do not count either.

• The quota is 5 creations per calendar month with the Pro plan and 100 with the Entreprise plan, for the whole account (all keys combined).
• A creation still counts if you delete the QR code afterwards: deleting a QR code does not give you a creation back.
• It is reset on the 1st of each month at 00:00 UTC, that is 01:00 in Switzerland (02:00 during summer time). Unused creations are not carried over.
• Once the month's quota is used up, each creation uses one creation from your API creation packs, starting with the oldest pack.
• When the month's quota and all your packs are used up, the creation is refused with the 429 quota_exceeded error, which gives the date the quota is reset. Nothing is billed per use.

The API keys screen shows where you stand: creations of the month used from your quota, creations taken from your packs, creations remaining in your packs and the date of the next reset. Your tool can read the same figures with GET /usage, with a key that has the Create QR codes right (see the API documentation).

Packs (+50, +100, +500, +1000 or +5000 creations) are bought in a single payment from the API creation packs card on the Subscription screen, with an active Pro or Entreprise subscription. They do not expire as long as your account stays on the Pro or Entreprise plan. Prices are on the Pricing page; purchase conditions and freezing on the Free plan are covered in Manage your subscription.

Rotate a key

The Rotate button generates a new secret for the key and immediately invalidates the old one. The key keeps its name and rights, and does not count as an extra key.

1. Click Rotate next to the key, then confirm.
2. Copy the new key on the Copy your API key now screen: as when it was created, it is only shown once.
3. Replace the old key in every tool that uses it: until you have done so, their calls are refused.

Rotate a key if you have lost it, if you think it may have been exposed (sent by email, published in a code repository, visible in a screenshot), or simply at regular intervals.

Revoke a key

The Revoke button makes the key unusable immediately and permanently. The tools that use it stop working at once. A revoked key disappears from the list and can be neither reactivated nor rotated.

Revoking does not affect your QR codes, including those created with this key, your quota or your packs. It frees up a place within your plan's key limit: you can then create a new key.

Revoke a key as soon as a tool no longer needs it, or if it may have been exposed and no tool should use it any more.

Frozen keys

A frozen key refuses all calls to the API, including reads, with the same error as an invalid key (401 unauthorized). It is neither revoked nor deleted: its name and rights are kept. A key is frozen when your plan allows fewer keys than you have. The account's administrators are informed by email, and a banner shows it in the dashboard.

When your account moves to the Free plan

If your Pro or Entreprise subscription ends (cancellation reaching its end date or a payment that has definitively failed), all your keys are frozen: the tools that use them stop working. The balance of your creation packs is frozen too, without being lost.

On the Free plan, the API keys screen does not show your keys: you can neither view, revoke, rotate nor reactivate them.

As soon as you take out a Pro or Entreprise subscription again, your frozen keys automatically become usable again, within the limit of the new plan: first those that were active when they were frozen, then the oldest. Any keys beyond the limit stay frozen.

When you move from the Entreprise plan to the Pro plan

The Pro plan only allows one active key. On the date of the change, the oldest key (by creation date) stays active and the others are frozen. They remain visible on the API keys screen with the Frozen badge. If you move back to the Entreprise plan, they become active again automatically.

Choose the active key

As long as your plan does not change, no frozen key is reactivated automatically. You choose:

• The Reactivate button appears next to each frozen key as long as your number of active keys is below your plan's limit. On the Pro plan, first revoke the active key, if there is one (revoking is permanent).
• The reactivated key works again immediately, with the same value and the same rights. If it may have been exposed, rotate it straight afterwards.
• Rotating does not reactivate a frozen key: it stays frozen.

Revocation by QR Suisse

QR Suisse may revoke all the API keys on your account, active or frozen, at the request of one of the account's administrators (write to contact@qrsuisse.ch from the email address you use for QR Suisse) or if a key may have been exposed to a third party or used without your consent. This is the solution in particular if a key has leaked while your account is on the Free plan, where you cannot revoke it yourself.

This revocation is immediate and permanent, like one you make yourself. The account's administrators are informed by email. Your QR codes, your quota and your packs are not affected. On the Pro or Entreprise plan, you can create new keys straight away. A frozen key that has been revoked is not reactivated when you take out a subscription again.

Rate limits and the 429 error

To protect the service, the number of calls is limited, over 60-second windows:

Beyond that, the API responds 429 rate_limited, with a Retry-After header that gives, in seconds, when to try again. Program your tool to wait for this delay before trying again, rather than repeating the call straight away.

Calls refused because of an invalid key (401 unauthorized) are also limited, to 60 per minute from the same IP address, and to 300 per minute for a whole IPv6 /48 network. Beyond that, the API responds 429 rate_limited for the rest of the minute, even with a valid key. A misconfigured tool that keeps trying with an old key can therefore temporarily block the other tools that call the API from the same address.

Do not confuse the two 429 errors: rate_limited means "too many calls in a short time, try again in a few seconds", quota_exceeded means "no creations left this month" (see "Creation quotas and packs").

Frequently asked questions

I have lost my key: can I get it back?

No. The full key is only shown once and we do not store it in plain text. Rotate it with the Rotate button: you get a new key, with the same name and the same rights. Remember to replace it in every tool that used the old one.

Why does the API respond 401 when I am using my key?

The API responds 401 unauthorized in all these cases, without telling them apart: a key that was copied wrongly or is incomplete, a revoked key, a key whose secret changed after a rotation, or a frozen key (for example because your account has moved to the Free plan). Check on the API keys screen that the key still exists, that it does not have the Frozen badge and that its last 4 characters match those of the key being used.

Why does the API return a 403 error?

With forbidden, the key is valid but its rights do not allow the requested operation: add the missing right under Key rights, then click Save rights. With account_disabled, the account is suspended or awaiting deletion: the key is not the problem, write to contact@qrsuisse.ch. With plan_required, the account no longer has an active Pro or Entreprise plan. With https_required, your tool called the API over http:// instead of https://: the request was not processed, but the key travelled in clear text. Change the address to https://app.qrsuisse.ch/api/v1, then rotate the key with the Rotate button.

What does the 429 error mean?

With rate_limited, your tool has sent too many requests in a short time: wait for the delay given by the Retry-After header, then try again. With quota_exceeded, the month's creation quota and your packs are used up: creating becomes possible again on the 1st of the following month, or as soon as you buy a pack.

A creation was interrupted by a network failure: how do I send it again without a duplicate?

If your tool sends the Idempotency-Key header with every creation (a new random value per creation), it can send the same request again with the same value within 24 hours: the API returns the QR code already created, without creating a second one or counting another creation. Without this header, check the list of your QR codes before sending it again: a successful creation still counts, even if you then delete the duplicate. The details are in the API documentation.

Does creating a key use up my quota?

No. Only QR codes created via the API count towards the monthly quota.

Are my QR codes created via the API deleted if I revoke the key?

No. Revoking a key neither changes nor deletes any QR code. The QR codes created with this key keep working.

Why can't I see the API keys screen?

The API keys screen is reserved for members who have the Manager of API keys permission (or Administrator). On the Free plan, it states that API access is available with the Pro and Entreprise plans, and any frozen keys are not shown there. Ask one of the account's administrators to give you the permission or to upgrade to the Pro plan.

My key may have been exposed: what should I do?

Rotate it immediately with the Rotate button if your tools need to keep using it, or otherwise revoke it with the Revoke button. In both cases, the old key stops working at once. If you cannot do this yourself, for example because your account is on the Free plan, write to contact@qrsuisse.ch from the email address of one of the account's administrators.

How many keys can I have?

One active key with the Pro plan, up to 10 keys active at the same time with the Entreprise plan. To create a new key, your frozen keys also count towards this limit, as long as you have not revoked them.

See also

• API documentation
• Manage your subscription
• Manage users
• Understand your account status