Generate and rotate API keys for programmatic access.
Talk to QorTrace programmatically — automate scans, audits, and Atlas operations.
Creating an API key
Account → API Keys → + New key.
You'll need to provide:
- Label — descriptive name (e.g. "CI pipeline")
- Scope — pick from
scan:read,scan:write,audit:read,audit:write,atlas:read,atlas:write, or*:*(Owner only) - Expiry — 30d / 90d / 1y / never (we recommend 90d)
We show the secret once. Copy it immediately into your password manager / CI secrets.
Using a key
Pass as a Bearer token:
BASH
export QT_API_KEY="qt_live_..."
curl https://qortrace.com/api/scan \
-H "Authorization: Bearer $QT_API_KEY" \
-H "Content-Type: application/json" \
-d '{"chain":"ethereum","address":"0xabc..."}'
Rate limits
- Free: 10 req/day
- Pro: 100 req/min
- Team: 1,000 req/min
- Enterprise: custom (no public ceiling)
429 responses include a Retry-After header. Be nice — we tier-limit per-key to protect upstream chain RPCs.
Rotating
You can:
- Regenerate the secret on an existing key (old secret instantly invalidated)
- Set up a "next key" so you can deploy + cutover without downtime
Schedule rotation in Account → API Keys → key detail → Rotate.
Revoking
Click Revoke — instant invalidation. Any in-flight requests with the revoked key get 401 immediately.
Best practices
- One key per consumer (CI, prod, dev) — never share keys across services
- Set the smallest scope that works (don't grant
*:*to a CI key) - Set an expiry — even 1y is better than never
- Audit key usage from Account → API Keys → key detail → Usage
SDKs
Official SDKs are at /docs/sdk-reference — Python, TypeScript, Go. They handle retries, pagination, and webhook signature verification for you.