Auth

Exchange API key for a short-lived JWT

Exchanges a long-lived API key for a short-lived JWT used by every other endpoint. This is the only endpoint that accepts an API key directly — callers should obtain a JWT here, then send it as Authorization: Bearer <token> to all other operations.

The returned JWT carries the caller's subscription tier as a claim and expires after expires_in seconds. Callers should refresh the token before expiry (or on a 401 response) by calling this endpoint again.

post/auth/token

Request

Base URL: https://api.qtsurfer.net/v1
URL: https://api.qtsurfer.net/v1/auth/token
Auth: API key in header X-API-Key

Response

API key accepted; JWT returned.

access_tokenstring required

Short-lived HS256 JWT. Send as Authorization: Bearer <token> on all other endpoints.

token_type'Bearer' required

Always Bearer.

expires_ininteger required

Seconds until the JWT expires (typically 3600).

scopesstring[]

Scopes granted to this token. Reserved for future use; currently always empty.

tier'free' | 'basic' | 'pro' | 'elite' required

Subscription tier this token was issued for. Drives rate limits and feature flags on downstream endpoints.

Example response

{
  "expires_in": 3600,
  "scopes": [],
  "tier": "free"
}

Changes

No operation changes recorded.