Get started

Authentication

Every QorBOM™ Partner API request requires a Bearer API key issued to your partner-tenant account. Apply via the partner application form — we'll mint and email you a sandbox key within two business days.

Key format

Key
qb_live_xxxxxxxxxxxxxxxx_yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy

live or test · 16-char lookup · 32-char secret

HTTP header
Authorization: Bearer qb_live_…

Same scheme Stripe, OpenAI, and Anthropic use. Drop into any standard HTTP client.

Storage & rotation

Show-once secret.The plaintext secret is shown to you exactly once during key creation. Store it in your secrets manager (1Password, HashiCorp Vault, AWS Secrets Manager) immediately. Lost keys can be revoked + reissued; the secret bytes cannot be recovered.

Rotation is recommended every 90 days. Generate the new key first (both old + new are valid during overlap), roll callers over, then revoke the old one.

Environments

EnvironmentKey prefixBase URL
Sandboxqb_test_…https://api.qorbom.com
Productionqb_live_…https://api.qorbom.com

Both environments live behind the same URL; the prefix decides the tenant routing. Test-mode scans count against a 25/day soft cap.

Example

curl https://api.qorbom.com/api/v1/cbom/health \
  -H "Authorization: Bearer $QORBOM_KEY"

The health endpoint is public, but sending your key lets the response include tenant-specific quota + rate-limit metadata in the X-QorBOM-* response headers.

Step 1 of 4

Navigate by section

The left rail groups every page in the QorBOM Partner API docs. Click any link to jump straight there — Quickstart, Authentication, Webhooks, and more.