API Key Auth

API keys are project credentials in the form:

<publicId>:<secret>

Create and rotate keys in QPub Cloud.

REST

import { QPub } from "@qpub/sdk";

const rest = new QPub.Rest({
  apiKey: process.env.QPUB_API_KEY,
});

await rest.channels.get("demo").publish({ text: "Hello" });

Or as a query parameter (less preferred — may appear in logs):

?api_key=<url-encoded publicId:secret>

Optional client identity:

X-Alias: my-server

WebSocket

Connect to wss://socket.qpub.io/v1 with:

?api_key=<url-encoded publicId:secret>

Optional: &alias=my-client.

import { QPub } from "@qpub/sdk";

const socket = new QPub.Socket({
  apiKey: process.env.QPUB_API_KEY,
  alias: "server-worker-1",
});

const rest = new QPub.Rest({
  apiKey: process.env.QPUB_API_KEY,
});

Security

• Use API keys only on trusted servers.
• For browsers, use Token Auth.
• Scope keys with permissions when creating them in QPub Cloud.
• Rotate keys if a secret leaks.