Skip to main content
The Qwoty API authenticates every request with an API token sent as a Bearer token. A token belongs to one workspace and is attached to one role.

​
Create a token

1

Open API Tokens

In qwoty.app, go to Settings › Developer › API Tokens. You need a role with the Developers right.
2

Create the token

Click Create API Token, enter a Token Name (for example “ERP sync”) and select a Role, then click Create Token.
3

Copy the token

Click Copy Token and store it in a secret manager or an environment variable.
The token is displayed only once. If you lose it, delete it and create a new one.
See API tokens for the full guide in the app.

​
Send the token

Include the token in the Authorization header of every request:
All endpoints live under the base URL https://qwoty.app/api. In this documentation, each endpoint page includes a playground: enter your token in its authorization field to send test requests. Requests sent from the playground use your real workspace data.

​
Token format

  • Production tokens start with qwt_prod_ followed by 64 hexadecimal characters (73 characters in total).
  • The examples in this documentation use qwt_prod_xxxxxxxxxxxxxxxx as a placeholder.
  • In Settings › Developer › API Tokens, a token is only shown by its first 12 characters (for example qwt_prod_e75...), with its role and Last Used date.

​
Scope, role and lifetime

  • Workspace: a token only reads and writes data of the workspace where it was created. To work with several workspaces, create one token per workspace.
  • Role: the token has the rights of the role selected at creation. Some write endpoints check these rights and return 403 when they are missing. See Permissions.
  • Lifetime: tokens do not expire. A token stays valid until you delete it, or until its role is deleted.
  • Revocation: delete the token in Settings › Developer › API Tokens. Requests using it are rejected immediately.

​
Authentication errors

See Error handling for all error formats.

​
Security best practices

Store tokens in environment variables or a secret manager. Never commit them to version control, never put them in client-side code (browser, mobile app), and never paste them in tickets or chats.
Create a separate token for each integration and environment, with a clear name. You can then revoke one without breaking the others, and the Last Used column tells you which tokens are still in use.
Attach each token to a role that has only the rights the integration needs.
Because tokens don’t expire, rotate them periodically: create a new token, deploy it, then delete the old one. Delete a token immediately if it may have leaked.

​
Need help?

Contact support@qwoty.io for any question about authentication.
Last modified on October 27, 2026