Authentication — QuantaAPI docs

You do not sign in to call a mock endpoint. There is no session, no OAuth flow, and no SDK. Every request is authorized by one header that belongs to the collection the endpoint lives in.

Header: x-collection-api-key
Value: The collection key, sent as-is
Scope: One key per collection, valid for every endpoint inside it
Required: Yes, on every mock request

Minimum working request

curl -X POST https://quanta-api-backend.vercel.app/endpoints/fetch/users \
  -H "Content-Type: application/json" \
  -H "x-collection-api-key: YOUR_COLLECTION_KEY" \
  -d '{"name":"Ada"}'

Getting the key

The key is created automatically with the collection and shown on the collection page in the dashboard. The person who owns the collection shares the key with you; consumers never generate a key themselves and never need an account.

Treat it as a passwordAnyone with the key can call every endpoint in that collection. Keep it in an environment variable or a secret store rather than committing it to your repository.

Rotating a key

The collection owner can regenerate the key from the dashboard. The old key stops working immediately, so every consumer must switch to the new value at the same time.

Rotation is immediate and irreversibleThere is no grace period. Coordinate the change with everyone who calls the collection before regenerating.

When the key is wrong

STATUS	CODE	DESCRIPTION
403	FORBIDDEN	The `x-collection-api-key` header is missing, or the key does not belong to any collection.
404	NOT_FOUND	The key is valid, but no endpoint in that collection matches the path and method.

A 403 means the credential is wrong. A 404 means the credential is fine and the request is aimed at something that does not exist — usually a typo in the path or a different HTTP method.