Zactonz Developers
Status Get an API key

Authentication

Every request needs an API key, sent as a Bearer token in the Authorization header.

Every endpoint on api.zactonz.com requires an API key. Send it on each request in the Authorization header using the Bearer scheme:

Authorization: Bearer YOUR_API_KEY

There are no other credentials, sessions or signatures to manage.

Example#

curl "https://api.zactonz.com/qr/enc/?content=https://zactonz.com" \
  -H "Authorization: Bearer YOUR_API_KEY"
<?php
$ch = curl_init('https://api.zactonz.com/qr/enc/?content=' . rawurlencode('https://zactonz.com'));
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER     => ['Authorization: Bearer YOUR_API_KEY'],
]);
$result = json_decode(curl_exec($ch), true);

Every reference page's samples include the header.

Getting a key#

Keys are issued by Zactonz support. Contact us with the endpoints you want to use and your expected volume. A key is scoped to the products it was issued for; calling an endpoint outside that scope is rejected.

Rejected requests#

status Meaning
401 The Authorization header is missing, malformed, or the key is not recognised.
403 The key is valid but not licensed for this endpoint.
406 The key has expired. Contact support to renew it.

The reply body follows the usual shape, with the reason in message:

{ "status": 401, "message": "Missing or invalid API key" }

Existing integrations#

Translator and Mail Verifier also accept the key as a key form field. That form is kept so current integrations keep working; new code should send the header. The retired video endpoints take key as a query parameter only.

Keep keys server-side#

A key sent from browser JavaScript is visible to anyone who opens the developer tools. Call the APIs from your own backend and proxy the result to the browser. Rotate a key through support if it is ever exposed.