API Keys

API keys (qk_ keys) let you connect external tools to Querri programmatically — BI tools, automation platforms, custom scripts, partner integrations — through a governed, auditable channel with fine-grained permission scopes.

Why API keys matter

Without API keys, people share data through shadow channels: emailed CSVs, shared credentials, screenshots on Slack. All of these are unauditable, unrevocable, and frozen at export time.

qk_ keys are strictly better than every real-world alternative:

• Auditable — you can see who created a key, when it was last used, and what it accessed
• Revocable — instant deactivation, no chasing down copies of a CSV
• Scoped — a key gets only the permissions it needs (Data Access, Full Access, or custom)
• Live — queries always return current data, not a stale export
• Time-limited — keys can have expiration dates for automatic rotation

The real comparison

The question isn’t “are API keys as secure as no sharing at all?” — it’s “are API keys more secure than emailing a CSV?” The answer is yes, by every measure.

Creating a key

1. Go to Settings > API Keys
2. Click Create API Key
3. Configure:
   • Name: A descriptive label (e.g., “Production BI Tool”, “Analytics Pipeline”)
   • Permission scope: Choose from preset scopes or customize
   • Expiration: Optional expiration date for automatic key rotation
4. Click Create
5. Copy the key immediately — it’s only shown once

Save your key

The full key is only displayed at creation time. If you lose it, you’ll need to create a new one and update your integration.

Permission scopes

Each key gets a specific set of permissions. Choose from presets or build a custom scope:

Preset	Permissions
Full Access	All API endpoints — projects, chats, dashboards, data, sharing, users, connectors, and more
Data Access	Read-only access to data sources, files, and query results

For custom scopes, you can combine individual permissions:

• Projects — create, read, update, delete projects
• Data — access data sources and query results
• Users — manage organization members
• Sharing — manage share links and permissions
• Connectors — manage data connectors

How security works

qk_ keys use a scoped permission model. A key can only perform the actions its scope allows, and never more than its creator can access.

• If you have access policies that restrict you to certain data, any key you create is also restricted
• If your policies change, the key’s effective access changes too — automatically
• No privilege escalation is possible

Using a key

Authenticate API requests with the key as a Bearer token:

# List accessible sources
curl -H "Authorization: Bearer qk_your_key_here" \
     -H "X-Tenant-ID: your_org_id" \
     https://app.querri.com/api/v1/sources

# Get paginated data (access policies applied automatically)
curl -H "Authorization: Bearer qk_your_key_here" \
     -H "X-Tenant-ID: your_org_id" \
     "https://app.querri.com/api/v1/sources/{source_uuid}/data?page=1&page_size=100"

See the API Reference for the full list of available endpoints.

Revoking a key

1. Go to Settings > API Keys
2. Find the key by name or prefix
3. Click Revoke

The key is immediately invalidated. Any requests using it will receive an error.

Admin controls

Admins can disable qk_ API key creation for the entire organization — see Admin Controls.

Best practices

• One key per integration — don’t share keys across tools
• Use the narrowest scope possible — give keys only the permissions they need
• Set expiration dates — use automatic expiration for keys that don’t need to live forever
• Rotate regularly — create a new key, update your integration, revoke the old one
• Monitor usage — check “Last Used” timestamps and the audit log for unusual activity
• Never commit keys to source control — use environment variables or secrets managers

Next steps

• API Reference — Full API documentation
• Access Policies — The policies that govern what keys can access
• Audit Log — Track key creation, usage, and revocation
• Admin Controls — Disable key creation at the org level