API Keys

API keys authenticate Socket and REST clients. Format:

<publicId>:<secret>

The secret is shown when the key is created — store it securely. The public id is used in token routes (/v1/key/:keyID/...).

Tasks

1. Open a project → API Keys.
2. Create a key; optionally set a permission map.
3. Copy the full key once and store it in your secret manager.
4. Update permissions or metadata as needed.
5. Delete compromised or unused keys.

Using the key

const rest = new QPub.Rest({ apiKey: process.env.QPUB_API_KEY });
const socket = new QPub.Socket({ apiKey: process.env.QPUB_API_KEY });

For browsers, do not embed the secret. Issue a JWT or token request from your backend instead.

Permissions

Keys can carry a permission map (publish, subscribe, enqueue, …). See Permissions.